What is Network Access Control (NAC)?
Network Access Control (NAC) is a network security discipline that decides which devices and users are allowed to connect to a network and under what conditions. NAC enforces security policies at the point of connection, placing non-compliant or unknown endpoints into quarantine or restricted segments before they can reach production resources.
What it does
NAC sits at the edge of a network and evaluates every device that tries to connect, whether over wired Ethernet, Wi-Fi, or VPN. Before granting access, it checks the device's identity, ownership status, and security posture. Based on those checks, it assigns the device to a VLAN, applies firewall rules, or blocks the connection entirely.
Core functions include:
- Authentication: Verifying device and user identity using 802.1X, digital certificates, RADIUS, TACACS+, or MFA.
- Posture assessment: Checking whether a device runs current antivirus software, has applied OS patches, or meets other policy requirements.
- Dynamic segmentation: Placing devices into the correct VLAN or network segment based on role, device type, or compliance state.
- Guest and BYOD management: Giving visitors or personal devices limited, isolated access without touching the corporate network.
- Continuous monitoring: Re-evaluating devices after they connect, not just at login time.
Why teams buy it
Unmanaged and IoT devices are common entry points for attackers. NAC gives security teams visibility into every device on the network and a mechanism to enforce policy before a device can move laterally. Regulated industries use NAC to demonstrate that only authorized, compliant endpoints touch sensitive systems. It also reduces the blast radius of a compromised device by keeping it in a restricted segment.
What to look for
- Protocol support: Does it handle 802.1X, MAC Authentication Bypass (MAB), and agentless profiling for devices that cannot run a client?