Framework № PCI DSS 4.0 от 01.03.2022

2.3.1 
Defined Approach Requirements: 
For wireless environments connected to the CDE or transmitting account data, all wireless vendor defaults are changed at installation or are confirmed to be secure, including but not limited to: 

Customized Approach Objective:
Wireless networks cannot be accessed using vendor default passwords or default configurations. 

Applicability Notes:
This includes, but is not limited to, default wireless encryption keys, passwords on wireless access points, SNMP defaults, and any other securityrelated wireless vendor defaults.
 
Defined Approach Testing Procedures:

Purpose:
If wireless networks are not implemented with sufficient security configurations (including changing default settings), wireless sniffers can eavesdrop on the traffic, easily capture data and passwords, and easily enter and attack the network. 

Good Practice:
Wireless passwords should be constructed so that they are resistant to offline brute force attacks. 

2.3.2
Defined Approach Requirements: 
For wireless environments connected to the CDE or transmitting account data, wireless encryption keys are changed as follows: 

Customized Approach Objective:
Knowledge of wireless encryption keys cannot allow unauthorized access to wireless networks. 

Defined Approach Testing Procedures:

Purpose:
Changing wireless encryption keys whenever someone with knowledge of the key leaves the organization or moves to a role that no longer requires knowledge of the key, helps keep knowledge of keys limited to only those with a business need to know. 
Also, changing wireless encryption keys whenever a key is suspected or known to be comprised makes a wireless network more resistant to compromise. 

Good Practice:
This goal can be accomplished in multiple ways, including periodic changes of keys, changing keys via a defined “joiners-movers-leavers” (JML) process, implementing additional technical controls, and not using fixed pre-shared keys. 
In addition, any keys that are known to be, or suspected of being, compromised should be managed in accordance with the entity’s incident response plan at Requirement 12.10.1.