What Is Network Access Control (NAC)?

Network access control (NAC) is a security approach that governs which devices and users are allowed to connect to a network and what they can do once connected. NAC enforces policy at the point of access: before a device is granted network resources, it is identified, authenticated, and checked against security requirements, and only compliant, authorized devices are admitted.

As networks fill with laptops, phones, IoT sensors, contractor devices, and virtual machines, NAC provides the gatekeeping function that answers a deceptively simple question: should this thing be on my network at all, and if so, where?

How Network Access Control Works

NAC operates in two phases that together define the entire model.

Pre-Admission Control

Before a device gains access, NAC evaluates it against policy. This includes authenticating the user or device, often through 802.1X, and performing a posture check: is the operating system patched, is endpoint protection running, is the device known and compliant? Devices that pass are admitted to the appropriate network segment; devices that fail are denied, quarantined, or placed in a remediation VLAN where they can be fixed before gaining full access.

Post-Admission Control

Admission is not a one-time event. Post-admission control governs what a device can do after it connects and continuously monitors its behavior. If a device that was compliant at login later behaves suspiciously or falls out of compliance, NAC can restrict its access, move it to a quarantine VLAN, or disconnect it entirely. This ongoing enforcement is what turns NAC from a doorman into a continuous control.

The pre-admission and post-admission split is the universal framework for understanding NAC, and every deployment implements both to some degree.

NAC and Zero Trust

NAC is a natural building block of a Zero Trust architecture. Zero Trust rejects the idea of a trusted internal network and insists that every access request be verified regardless of origin. NAC operationalizes that principle at the network layer: it never assumes a device belongs simply because it is plugged in, it verifies identity and posture before granting access, and it continuously re-evaluates trust. By enforcing least-privilege network access and dynamic segmentation, NAC gives Zero Trust programs a concrete mechanism for controlling device-level access, which is why vendors increasingly frame NAC as a Zero Trust enabler.

Why Organizations Use NAC (BYOD, IoT, Compliance)

Three pressures drive NAC adoption. Bring-your-own-device policies put unmanaged personal devices on corporate networks, and NAC enforces posture requirements before they connect. The explosion of IoT and operational technology adds large numbers of devices that cannot run traditional agents; NAC discovers, profiles, and segments them so a vulnerable sensor cannot reach critical systems. And compliance frameworks across regulated industries expect organizations to control and document network access, which NAC provides through policy enforcement and detailed logging.

NAC Deployment Models (Agent-Based vs. Agentless)

NAC can be deployed with or without software on the endpoint. Agent-based NAC installs a client that performs detailed posture assessment and continuous compliance checks, offering deep visibility on managed devices. Agentless NAC evaluates devices without installed software, using techniques such as network scanning, DHCP and traffic fingerprinting, and directory integration, which is essential for IoT, guest, and unmanaged devices that cannot host an agent. Most real-world deployments blend both: agents on corporate endpoints, agentless profiling for everything else.

NAC vs. Other Access Controls (IAM, ZTNA)

NAC is one of several access-control disciplines, distinguished by what it governs. IAM controls identity and application access, answering “who is this user and what apps can they use.” NAC controls network admission, answering “can this device join the network and which segment.” Zero Trust Network Access (ZTNA) provides identity-aware, application-level access to specific resources, typically for remote users, without granting broad network access at all. These controls overlap and increasingly integrate, but NAC’s distinct role is enforcing device-level admission and segmentation at the network layer.

Best Practices for Implementing NAC

• Start with visibility: discover and profile every device on the network before enforcing policy.
• Roll out enforcement in phases, beginning in monitor mode to avoid locking out legitimate devices.
• Use 802.1X authentication where the environment supports it, with fallbacks for devices that cannot.
• Define clear posture policies and a remediation VLAN so non-compliant devices can self-fix.
• Segment aggressively: place IoT, guest, and BYOD devices in isolated VLANs by default.
• Integrate NAC with IAM, endpoint protection, and SIEM so access decisions use shared context.
• Maintain post-admission monitoring, not just entry checks, and revisit policies as the device landscape changes.

FAQ

What is the difference between pre-admission and post-admission NAC?

Pre-admission control evaluates a device before granting access, checking identity and security posture. Post-admission control governs and monitors what the device does after it connects, restricting or removing access if it becomes non-compliant or suspicious.

Is NAC part of Zero Trust?

NAC is a key enabler of Zero Trust at the network layer. It enforces the Zero Trust principles of never trusting by default, verifying before granting access, and continuously re-evaluating trust for devices.

What is agentless NAC used for?

Agentless NAC handles devices that cannot run installed software, such as IoT, operational technology, guest, and unmanaged devices, profiling and controlling them through network-based techniques rather than an endpoint agent.

How is NAC different from IAM?

IAM controls user identity and application access, while NAC controls whether a device may join the network and where it is placed. They address different layers and work best when integrated.