For a new SSID on a Cisco Catalyst 9800 Series WLC that must be broadcast on 6 GHz radios with users required to use EAP-TLS for authentication, the required wireless Layer 2 security method is WPA3 Enterprise. This method provides the necessary framework for EAP-TLS, which is a certificate-based mutual authentication protocol2. References: Cisco documentation on Configure Local EAP Authentication on Catalyst 9800 WLC2.