What Is Network Access Control (NAC)?

Network access control decides what a device may do when it connects to the network, based on who it belongs to and what state it is in. It is the system; the protocol it most commonly uses is covered in 802.1X.

The problem it addresses is straightforward: physical or wireless connectivity should not automatically confer network access, because anyone in the building — contractor, visitor, cleaner, attacker — can reach a port.

Identity and posture together

Two questions are asked at connection. Who is this device or user, established by certificate or credential? And is the device in an acceptable state — managed, patched, running required protection?

The answers determine placement: full access, a restricted segment for guests or unmanaged devices, a quarantine network for remediation, or refusal. That decision replaces the default where any connected device lands on the production network.

The devices that cannot authenticate

Every estate contains equipment that cannot participate in authentication — printers, cameras, building controllers, medical devices, industrial equipment. These are precisely the devices an attacker would like to impersonate.

The usual accommodation is address-based exemption, which is weak because addresses are trivially spoofed. Better approaches use profiling to verify a device behaves like what it claims, combined with placing these devices in restricted segments where impersonation gains little.

That last point matters more than the authentication method. If the printer segment can reach only the print server, impersonating a printer is not worth much.

Why deployments stall

Because the failure mode is visible and disruptive. A misconfiguration prevents legitimate users working, which generates immediate pressure to relax enforcement — and relaxations tend to become permanent.

Phased rollout addresses this: monitor mode first to discover what is actually connecting, then enforcement for one building or one device class, then expansion. Attempting enforcement everywhere simultaneously is how these projects acquire a reputation.

Guest and contractor access is the routine use

Beyond blocking unauthorised devices, the everyday value is handling the people who legitimately need limited access. Contractors, auditors, vendors performing maintenance and visitors all need something, and the default in many organisations is either full access or an ad-hoc arrangement.

Automated provisioning of time-limited, scope-limited access solves a real operational problem and removes a recurring security one. Access that expires automatically at the end of an engagement does not depend on anyone remembering to revoke it.

That is frequently the capability that justifies the deployment to the business, because it makes something easier rather than only making something harder.

Availability of the control itself needs thought. If the policy service is unreachable, does the network fail open or closed? Failing closed preserves the control and can prevent an entire site working; failing open keeps people productive and suspends enforcement. Most organisations choose open, and the decision should be explicit rather than inherited from a default.

A common mistake worth avoiding

Where to start

Run in monitor mode for a month and look at what connects. The unexpected devices in that list justify the programme better than any argument about unauthorised access.

See secure hospital Wi-Fi. GuardsArm runs security program reviews.