What Is Network Access Control (NAC)?
Network Access Control (NAC) decides which devices may join a network and what they may reach once connected. Rather than trusting any device that plugs in, NAC authenticates it and often checks its security posture first — turning the network port from an open door into a checkpoint. It is a practical step toward zero trust at the network edge.
What does NAC actually enforce?#
NAC combines identity and posture before granting access:
- Authentication — the device (and often the user) must prove identity, commonly via 802.1X against an authentication server.
- Posture assessment — is the device patched, running required security software, configured correctly?
- Enforcement — compliant devices get appropriate access; non-compliant ones are quarantined, restricted, or sent to remediation.
The result is that an unmanaged laptop or an out-of-date device cannot simply appear on the network and reach everything — it is checked and placed accordingly.
How does NAC fit modern security?#
| Role | Contribution |
|---|---|
| Device authentication | Only known devices join |
| Posture check | Unhealthy devices are contained |
| Dynamic segmentation | Access matched to identity/role |
| Guest/IoT isolation | Untrusted devices kept separate |
This directly supports segmentation and least privilege — access is granted per device and role, not per network jack.
NAC is access control applied at the network layer. More at the Network Security hub.
Frequently asked questions#
What is Network Access Control?
Network Access Control (NAC) is a set of technologies that decide which devices are allowed to connect to a network and what they may access once on it. NAC authenticates the device and often checks its security posture — patch level, antivirus, configuration — before granting access, quarantining or restricting devices that do not comply.
What is 802.1X and how does it relate to NAC?
802.1X is a standard for port-based network access control that authenticates a device before it is allowed onto a wired or wireless network. It is a common building block of NAC: the device must present valid credentials to an authentication server before the switch or access point grants network access.