WEP and WPA and the other pre-802.11i algorithms do not meet FIPS 140 and may not be used; for every agency-managed access point on a network carrying unencrypted CJI the agency tests for rogue access points, inventories all APs and 802.11 devices, secures APs physically, tests and limits coverage to operational need, protects the management interface with authentication and encryption, uses strong administrative passwords changed per the IA family, controls the reset function and restores security settings afterwards, changes the default SSID, disables SSID broadcast and keeps agency identifiers out of it, enables all security features, uses keys of at least 128 bits with default shared keys replaced, disables ad hoc mode and non-essential management protocols, manages only over FIPS-compliant secure protocols, enables logging and reviews logs at least monthly, isolates the wireless network from the wired infrastructure by VLANs, ACLs or firewalls, and clears configuration from access points before disposal.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.