This selects, as a bitmask, which data-frame cipher types this service policy supports — wep40(2), tkip(4), aesccmp(16), wep104(32), wpisms4(64), and wep128(128) — combining several values together when multiple ciphers should be allowed at once; a value of 0 means no configuration or an undo operation. An admin sets this to match whatever encryption the SSID's clients are expected to use, for example combining tkip and aesccmp to support both older and newer WPA/WPA2 clients on the same network.