Wireless Access Authorization

Objective [a] is an inventory and [b] is an approval gate in front of it.

List the wireless access points and networks in scope, and require authorization before any user or device connects. Policy names who approves and what qualifies, and configuration enforces it. The pairing to show an assessor is the current access point list next to the mechanism that keeps unapproved devices off.

WPA2 with a pre-shared key, one WiFi password shared by everyone, clears this requirement.

Authentication and encryption at the access point are what matter here. Certificate-based onboarding and 802.1X, the per-user network logon standard, are stronger and serve IA.L2-3.5.2 well. They are not the bar for AC.L2-3.1.16, and building a RADIUS authentication server solely for this requirement is effort spent past the objective.

Provision the key so users never learn it.

IT joins devices to the wireless during setup, or the device management platform pushes the WiFi profile. Authorization and connection then become the same controlled event, and the pre-shared key stops circulating on whiteboards. Rotate a shared key whenever someone who knows it leaves, which is also the reason larger teams outgrow shared keys.

No wireless does not mean not applicable.

If wireless is disabled or was never deployed, write the requirement as met: policy prohibits wireless access and configuration enforces the prohibition. That answer is verifiable. A not-applicable claim invites a scoping argument you do not need.