Need indicators
This capability is usually relevant when these signals appear in the operating environment.
Unknown devices on the network.
Guests and third parties connect without segmentation.
Limited visibility into device posture.
Back to solutions
Discuss your use case
What is this solution?
NAC makes a network admission decision when a user or device connects through an integrated wired switch or wireless access point. It evaluates identity or device posture and returns an allow, restrict, or guest network decision where enforcement supports it. It does not replace controls on traffic after admission.
Network access control can combine 802.1X network authentication with device posture assessment where suitable admission signals are available.
Practical example
A visitor connects to the office network. Networking identifies the device as noncorporate and tests steering it to guest access under policy.
Technical summary and scope of use
Technical explanation
Network Access Control (NAC) is a security technology for managing and monitoring the access of users and devices to wireless and wireless networks. it works by verifying the identity of the user or device, then applying authorization rules that determine whether it is permitted to connect, and any network, domain or port he can use it.
The technology is based on mechanisms such as 802.1X, RADIUS server, MAC address authentication, and captive portal, with the ability to link them to internal and external identity databases. It also provides instant vision for connected devices, access bases, network switches, subnetworks, hardware status, and authorization events.
Network Access Control (NAC) technology helps organizations know each device or user trying to connect to the network, then determine whether it should be allowed to access, where it can access, and under any security rules.
Instead of allowing any device to be directly connected, the identity or device is verified first, then the appropriate access policy is applied. employees can be allowed to access according to specific controls, guest devices can be directed to the registration portal, and untraditional devices can be dealt with through their own authentication.
Security and IT teams also provide a clear view of what is happening within the network, including connected devices, ports, subnetworks, and authorization events, with the possibility to automatically isolate incompatible or dangerous devices.
Scope of use
The technology is used in wireless and wireless environments, multi-systems, and environments that need a centralized management to access, monitor compliance, isolate incompatible devices, and connect other security systems.
The technical objective is:
- Verify the identity of devices and users before giving access
- Implementation of Central Access Policy
- Monitoring of devices and communications within the network
- Uncompatible or dangerous equipment.
- Strengthening compliance and security governance
What it delivers
Core capabilities that turn the requirement into practical controls.
Access control and authentication
Databases and identity integration
Visibility and monitoring
Expected value
The impact security teams and leadership can expect from the right implementation.
More controlled network
Reduced unauthorized device access
Better risk segmentation
Technical capabilities
Feature availability depends on product version, target systems, deployment, and integrations. Compatibility includes legacy mechanisms such as PAP, EAP-MD5, and Telnet; listing them is not a recommendation to enable them. Prefer EAP-TLS where suitable and limit exceptions to devices that cannot support stronger alternatives.
Access control and authentication
Authorization of users and devices in wireless and wireless networks
Associate users or groups with authorized scope and review how membership changes affect access.
Support of the 802.1X Protocol
Authenticate the user or device at the network port before granting appropriate access.
The radio server is integrated.
Exchange authentication requests, access decisions, and attributes between network and identity components.
Approval by MAC address
Identify a device by its interface address; it can be spoofed and is not strong authentication.
Access through Captive Portal
Direct devices to registration or verification before granting the access defined by network policy.
Registration of user devices through the portal
Associate users or groups with authorized scope and review how membership changes affect access.
Supporting accurate access rules based on security policies
Turn organizational requirements into testable settings and define who may approve exceptions.
Apply the principle of default uncertainty so that each connection is defined and verified before permitted.
Define who may perform the action and within which scope; test that unauthorized requests are denied.
Support for termination of communication via RADIUS CoA, SNMP, Telnet and SSH
Update authorization or disconnect an active session where the network device supports the message.
Support of authorization methods:
Define who may perform the action and within which scope; test that unauthorized requests are denied.
PAP
A legacy compatibility option to restrict to exceptions, not a default replacement for stronger authentication.
EAP-MD5
A legacy compatibility option to restrict to exceptions, not a default replacement for stronger authentication.
CHAP
A legacy compatibility option to restrict to exceptions, not a default replacement for stronger authentication.
MSCHAPv1
A legacy compatibility option to restrict to exceptions, not a default replacement for stronger authentication.
MSCHAPv2
A legacy compatibility option to restrict to exceptions, not a default replacement for stronger authentication.
EAP-TLS
Use certificate-based authentication with 802.1X; test the trust chain and device certificate revocation.
EAP-FAST
A tunneled authentication method; review server certificate validation and the inner authentication method.
PEAP
A tunneled authentication method; review server certificate validation and the inner authentication method.
TTLS
A tunneled authentication method; review server certificate validation and the inner authentication method.
TEAP
A tunneled authentication method; review server certificate validation and the inner authentication method.
MAC
Identify a device by its interface address; it can be spoofed and is not strong authentication.
Captive Portal
Direct devices to registration or verification before granting the access defined by network policy.
Kerberos
Use trusted tickets inside the identity domain; verify clock alignment and the issuing authority.
Tacacs+
Separate authentication, authorization, and accounting for network-device administration where integrated.
Token
Define who may perform the action and within which scope; test that unauthorized requests are denied.
Databases and identity integration
Integrated Local Database for Users and Devices
Turn organizational requirements into testable settings and define who may approve exceptions.
Integration with Active Directory
Connect accounts or groups to the organization’s directory; review bind permissions and group synchronization.
Integration with LDAP
Connect accounts or groups to the organization’s directory; review bind permissions and group synchronization.
Integration with SQL
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Support for Microsoft SQL
Turn organizational requirements into testable settings and define who may approve exceptions.
Support of MySQL
Turn organizational requirements into testable settings and define who may approve exceptions.
Support for PostgreSQL
Turn organizational requirements into testable settings and define who may approve exceptions.
Support for Oracle
Turn organizational requirements into testable settings and define who may approve exceptions.
Support for ODBC
Turn organizational requirements into testable settings and define who may approve exceptions.
Integration with Radius.
Exchange authentication requests, access decisions, and attributes between network and identity components.
Integration with EDUROAM
Verify the eduroam authentication path between the institution and its partner and the authorization attributes exchanged.
Integration through API
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Integration with Google Workspace
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Support of Kerberos
Use trusted tickets inside the identity domain; verify clock alignment and the issuing authority.
Support Google, LinkedIn, Facebook and MiniOrange accounts through the guest portal
Direct devices to registration or verification before granting the access defined by network policy.
Visibility and monitoring
Collect comprehensive information about identities and connected devices
Show activity within the covered scope and associate events with an asset or session during review.
View the authorization base that has been granted access
Define who may perform the action and within which scope; test that unauthorized requests are denied.
View the network key used.
Show activity within the covered scope and associate events with an asset or session during review.
Display of the device-related subnetwork
Show activity within the covered scope and associate events with an asset or session during review.
Showing information in a searchable schedule
Show activity within the covered scope and associate events with an asset or session during review.
Graphic presentation of the network components
Show activity within the covered scope and associate events with an asset or session during review.
Network monitoring through SNMP
Query network devices within defined permissions; validate protocol version and access settings before enabling it.
Real-time monitoring of load, authorization decisions, and device status
Review load and admission decisions to identify elevated demand or service disruption.
Monitoring of end devices.
Show activity within the covered scope and associate events with an asset or session during review.
Planning fees for the physical topology of the network
Show activity within the covered scope and associate events with an asset or session during review.
Monitoring of authorization events and network switches status
Show activity within the covered scope and associate events with an asset or session during review.
Network management
The DHCP server is integrated.
Assign network addresses and settings to covered devices; define the address scope before enabling it.
Managing and Imaging Network Addresses
Track address assignment and its source and associate changes with the affected segment and device.
Discover unautorized DHCP servers
Detect address offers from unapproved sources to identify the segment that needs investigation.
Management of port settings on network switches
Configure behavior for the use case and retain the approved configuration for review or rollback.
Enable and disconnect the ports.
Apply access decisions at supported ports and test recovery to avoid isolating a healthy device.
The TFTP server is integrated.
Transfer files on an authorized compatibility path; TFTP does not provide encryption by itself.
Storage of network devices
Configure behavior for the use case and retain the approved configuration for review or rollback.
Comparison of Network Devices
Configure behavior for the use case and retain the approved configuration for review or rollback.
Security integration
Integration with other security systems
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Exchange of information with:
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Firewalls
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
Security event management systems
Verify that network admission events and allow or deny decisions can be sent to the supported event management system and correlated with the device and identity.
The malware system
Identify both integration endpoints and the data they exchange; verify behavior if either endpoint is unavailable.
System of Equipment Management
It provides management capabilities for network addresses, settings and network devices.
Automatic response to detected threats
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Blocking or isolating dangerous devices.
Isolate the item or access path when policy conditions are met; define review and release to limit unintended impact.
Centralized administration
Central management through a graphic interface
Bring configuration and monitoring into one management point while keeping operator permissions restricted.
Creating administrative groups.
Bring configuration and monitoring into one management point while keeping operator permissions restricted.
Delivery of detailed powers
Bring configuration and monitoring into one management point while keeping operator permissions restricted.
Support for uneven networks
Bring configuration and monitoring into one management point while keeping operator permissions restricted.
Working in multi-dimensional environments
Bring configuration and monitoring into one management point while keeping operator permissions restricted.
Automatic detection of network devices.
Bring configuration and monitoring into one management point while keeping operator permissions restricted.
Digital certificates
The CA server is integrated to validate certificates.
Issue certificates to covered devices; protect the issuing authority and revoke certificates when devices leave.
Support for Multiple Environments for Certificates
Link the certificate to its owner and asset and track issuance or renewal to avoid late manual replacement.
Distribution of certificates through SCEP
Integrate certificate enrollment or renewal with a compatible issuer; test authorization, renewal, and revocation.
Guest access
Access through Captive Portal
Direct devices to registration or verification before granting the access defined by network policy.
Captive Portal is dedicated.
Direct devices to registration or verification before granting the access defined by network policy.
Support for multiple languages
Choose a suitable operator language and verify that fields and reports remain consistent when switching.
Registration of new guest accounts.
Define the guest approver, access duration, and permitted scope before network connection.
Support for temporary accounts
Associate users or groups with authorized scope and review how membership changes affect access.
Support of sponsors.
Define the guest approver, access duration, and permitted scope before network connection.
Availability and reliability
Support for high availability
Measure behavior under expected load and during a component interruption or recovery.
Support for distributed version
Measure behavior under expected load and during a component interruption or recovery.
Physical toopology of the network
Measure behavior under expected load and during a component interruption or recovery.
Endpoint inspection and posture assessment
Lightweight endpoint posture agent
Collect approved endpoint posture signals for the policy-based admission decision.
Excluding equipment that does not meet the safety requirements
Define whether a noncompliant device is denied or sent to a remediation network under admission policy.
Check anti-malware status
Where supported, verify the required protection is enabled and reports an acceptable state before admitting the device.
Check required operating system updates
Compare device state against required updates and define remediation for devices that fall short.
Inspection of the discs.
Limit data readability without the required keys; confirm where encryption starts and ends.
Check endpoint firewall status
Where the signal is available, confirm the endpoint firewall is enabled as required before admission.
Inspect running processes
Compare running processes with defined admission signals without implying full EDR-style behavioral analysis.
Check files required by admission policy
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Check the key records.
Record what happened, when, and in which scope; review event fields and retention for investigation and audit.
Check whether the device is joined to the organizational domain
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Check required endpoint applications
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Support of systems:
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Windows
Identify a supported operating or managed platform; verify version, enrollment, and available policies.
Linux
Identify a supported operating or managed platform; verify version, enrollment, and available policies.
Mac OS
Inspect a sample in the supported scope and compare the signals with both normal and unusual activity.
Additional characteristics
Classification of End Equipment
Assign information to a category that determines how it is handled so safeguards reflect sensitivity.
Finishing sessions using the agent.
Set session lifetime and reauthentication behavior; verify revocation after entitlement removal.
OTP support for virtual private networks registration
Use a time- or use-limited code; test expiry and rejection of invalid or replayed codes.
Management of End Devices through Captive Portal
Direct devices to registration or verification before granting the access defined by network policy.
Assistant app for the automatic network setting
Configure behavior for the use case and retain the approved configuration for review or rollback.
Restoring Passwords through the Portal
Connect defined actions or data to other systems; review authorization, authentication, and failure handling.
The Tacacs+ server is integrated.
Separate authentication, authorization, and accounting for network-device administration where integrated.
Passive device profiling
DNS
Manage the configuration through domain records and verify published values and propagation before rollout.
RADIUS
Exchange authentication requests, access decisions, and attributes between network and identity components.
Vendor OUI
Use the MAC prefix to infer the vendor, not as trusted device identification.
Active Directory
Connect accounts or groups to the organization’s directory; review bind permissions and group synchronization.
HTTP and HTTPS
Add asset-identification signals through the supported path; restrict active probing to approved assets.
CDP and LLDP
Use neighbor advertisements to identify device type and port without treating them as proof of identity.
Active device profiling
WMI
Query attributes of approved Windows devices with permissions limited to inventory.
SNMP
Query network devices within defined permissions; validate protocol version and access settings before enabling it.
NMAP
Probe ports or services on approved assets; assess operational devices before active scanning.
TCP
Add asset-identification signals through the supported path; restrict active probing to approved assets.
DHCP Fingerprinting
Use DHCP request characteristics to infer device type, not as proof of identity by itself.
DHCP SPAN
Use DHCP request characteristics to infer device type, not as proof of identity by itself.
Agent
Use information from this component where integrated and review which attributes inform access decisions.
MDM
Use information from this component where integrated and review which attributes inform access decisions.
UTM
Use information from this component where integrated and review which attributes inform access decisions.
NGFW
Use information from this component where integrated and review which attributes inform access decisions.
API
Use information from this component where integrated and review which attributes inform access decisions.
ONVIF
Help identify supported video devices such as in-scope network cameras.
How the technology works
Discovery
The technology uses automatic detection and negative and active classification methods to identify network devices and their features.
approved
Mechanisms such as 802.1X, RADIUS, MAC, Captive Portal, Kerberos and Tacacs+ use to verify users and devices.
Authorization
Access rules apply to determine the level of access permitted for each device or user.
Isolation
They may block or isolate dangerous or unconformed devices.
Monitoring
It provides instant monitoring of devices, ports, authorization events and the physical topology of the network.
Control
It allows remote control and enabled or disable network ports.
Management of Equipment
It provides management capabilities for network addresses, settings and network devices.
The compliance examination.
Examine the state of end-to-end devices such as updates, firewalls, encryption, anti-malware and applications.
Reaction
It supports automatic response to threats by integrating with other security systems.
reports
It provides reports and detailed information about the network, devices and access events.
What to validate before rollout
- Define how wired and wireless access identify the user or device.
- Test allow, restrict, or segment decisions at the enforcement point.
- Define and test guest and specialist device policies before expanding rollout.
Integration and scope
Review authentication and enforcement support on switches and access points. Test guest devices and devices that cannot use the primary authentication method.
Challenges this solution addresses
- Unautorized access to the network.
- Weak verification of user and device identity.
- Lack of vision around connected devices
- Difficulty in finding the device connected to any port or subnet
- Weak control of guest arrival.
- Challenges of User Device Management
- Difficulty in handling untraditional devices.
- Incoherence in Access Policy
- Disadvantage of monitoring of authorization events
- Difficulty in detecting unauthorized DHCP servers
- Difficulty in managing network ports centrally
- Discovery of incompatible devices
- The need to isolate dangerous devices.
- Difficulty integration between access control and other security systems
- Weak security support.
- Difficulty in managing multiple networks
Regulatory alignment
Illustrative ways to support control implementation. An area may have more than one example; each row is not necessarily a separate official control.
NCA · ECC 2:2024For entities within the scope of the Essential Cybersecurity Controls.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Management of assets | Provides vision for connected devices, classifies end devices and collects information about devices and identities Related capability: Network vision, hardware classification and automatic detection | Applied |
| Identity and access management | Verify users, devices and authorization applications before granting access Related capability: 802.1X, RADIUS and MAC authentication and access ports | Applied |
| Protection of systems and processing facilities | Prevent or isolate equipment that does not meet the safety requirements Related capability: Monitoring and isolation of equipment. | Applied |
| Network Security Management | Application for access control, subsidiary networks support, port management and unauthorized DHCP detection Related capability: Port and Subnet Management and DHCP Discovery | Applied |
| mobile device security. | Support for registration of user devices through the portal Related capability: Registration of devices through the portal. | Applied |
| Cryptography | Support for Digital Certificates Related capability: CA, SCEP and digital certificates | Applied |
| Management of deficiencies | Inspecting the security elements on end devices and eliminating incompatible Related capability: Inspection of updates, encryption and firewalls | Applied |
| records and monitoring. | Providing monitoring, reports and authorization events Related capability: Monitoring, reports and authorization events | Applied |
| Incident and threat management | Automatic response to threats and equipment isolation Related capability: Safety integration and automatic isolation | Applied |
| The cyber continuity | Support for high availability and distributed version Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: High availability and distributed version | Applied |
| Security of the third party. | Integration with different security systems and non-homogeneous networks Related capability: Security integrations and multi-system networks | Applied |
SAMA · CSFFor financial institutions within the Saudi Central Bank framework, subject to the control's applicability.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Security Governance | The technology supports the implementation of centralized policies for network access control, helping to unify access controls and monitor their commitment within a technical environment. Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Central Management of Policy and Access Rules | Applied |
| Identity and access management | The technology verifies the identity of users and devices before granting access, and authorization applies on the basis of specific rules that prevent unauthorized access. Related capability: Certified via 802.1X, RADIUS, MAC and Captive Portal | Applied |
| Management of Privileges and Powers | The technology enables access permissions to be identified and linked with accurate authorization rules, with the possibility of reviewing authorization events and tracking devices and authorized users. Related capability: Authorization and Central Access Management | Applied |
| Management of assets | The technology provides discovery and vision for network-connected devices, collecting information about the identity, device, network key, subnetwork, and the authorization base used. Related capability: Network vision, hardware classification and automatic detection | Applied |
| Risk Management | The technology helps to reduce the risks of unauthorized access, and the risks of unknown or incompatible devices, by pre-confirming and isolating when necessary. Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Control of access and isolation of incompatible devices | Applied |
| Management of deficiencies | The technology examines the end-to-end device status in terms of updates, anti-malware, firewall, encryption, processes, files, applications, and log keys Related capability: Testing of the end devices. | Applied |
| Security Monitoring | Monitors network devices and endpoints, including load checks, authorization counts, operational status, and access events Related capability: Monitoring through SNMP and monitoring of authorization events | Applied |
| Events and records. | Records authorization and access events and makes them available for viewing, search, and reporting. Related capability: Reports, Authorization Events and Table Presentation | Applied |
| Protection of data | Limit unauthorized access to network resources and data by verifying identity and authorization before allowing the connection Related capability: Access control and approval before contacting | Applied |
| Management of Networks | Technology supports network management through port control, network address management, unauthorized DHCP server detection, and network device settings management Related capability: Port and IPAM management and unauthorized DHCP discovery | Applied |
| Protecting the systems | The technology helps prevent unautorized or incompatible devices from connecting to network resources, with the possibility of blocking or isolating them. Related capability: Blocking, isolating and verifying compliance. | Applied |
| Incident response | The technology supports automatic response when a threat is detected from other security systems, by blocking or isolating the device’s danger. Related capability: Security integration and automatic response | Applied |
| Continuity of business | Supports reliability technology through high availability and distributed version, contributing to continued access control and monitoring functions Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: High availability and distributed version | Applied |
| Security of third parties | The technology supports integration with multiple security systems and operates in unharmonic networks, helping to unify control and monitoring across multiple environments. Related capability: Integration with security systems and non-homogeneous networks | Applied |
| Protection of Critical Environments | This technology helps to adjust access to sensitive networks and resources and prevents the connection of unauthorized or incompatible devices. Related capability: Control and isolation of dangerous devices. | Applied |
| compliance and audit | The technology provides detailed information about the equipment, authorization events, network status, and applied policies, supporting periodic review and compliance Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Reporting, monitoring and authorization records | Applied |
| Protection of Infrastructure | The technology supports the protection of network infrastructure by controlling ports, monitoring network devices, and detection of operating breaches. Related capability: Port Management and Network Monitoring | Applied |
| Operational Security | The technology enables centralized network management, continuous monitoring and automatic response to events that affect access and operation security. Related capability: Central management, monitoring and automatic response | Applied |
| Security of cloud environments | The technology supports integration through software interfaces, external databases and identity systems, helping to unify access management when appropriate integrations are available. Related capability: Integration through API and external identity bases | Applied |
| Protection of sensitive financial systems | This technology supports restriction of access to sensitive networks and systems based on verification and authorization, while monitoring devices and access-related events Related capability: Certification, authorization and monitoring of connected devices | Applied |
NCA · OTCC-1:2022For operational technology and industrial control environments to which the controls apply.
Evaluate these examples against the facility level and assets in scope. They do not authorize IT/OT connectivity or component installation on operational assets without assessment.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Management of assets | Providing discovery, classification and vision for network-connected devices Related capability: Automatic detection, hardware classification and network vision | Applied |
| Identity and access management | Application of authentication and authorization for devices and users before access Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: 802.1X, RADIUS and MAC authentication and access ports | Applied |
| Network Security Management | Support access control, subnetworks, port management and unauthorized DHCP detection Use only authorized paths and assets. Network isolation and remote-access approval requirements still apply. Related capability: Port and Subnet Management and DHCP Discovery | Applied |
| mobile device security. | Support for registration of user devices through the portal Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. Related capability: Registration of devices through the portal. | Applied |
| Management of deficiencies | Inspect security elements on end devices and eliminate incompatible devices Related capability: Compliance inspection and verification of protective elements | Applied |
| Recording and monitoring of events | Providing monitoring, reports and authorization events Related capability: Monitoring, reports and authorization events | Applied |
| Incident and threat management | Automatic isolation or blocking of dangerous devices Related capability: Security integration and automatic response | Applied |
| Continuity | Support for high availability and distributed version Test failure and recovery paths. This capability does not replace a complete continuity or recovery plan. Related capability: High availability and distributed version | Applied |
“Applied” describes the capability in the illustrative example, not an implementation or compliance status for the customer.
Decision questions
Questions before you start
How do we know this solution is right for us?
Start with the risk signals on this page. If they match your environment, they can be turned into a short assessment that defines scope, priority, and a practical implementation approach.
How do we start without adding operational complexity?
Start with a focused risk and scope assessment, then define implementation priorities, technical requirements, and phased rollout steps.
Related solutions
ZTNA
Zero Trust Network Access
Grant precise application access instead of exposing the entire network to a user or device.
Explore solutionNDR
Network Detection and Response
Analyze network traffic to detect abnormal behavior and hidden threats.
Explore solutionUEM/MDM
Unified Endpoint and Mobile Management
Manage device policies, applications, updates, and access to enterprise data.
Explore solutionAsset Advisory
Asset Management Advisory
Build an operational asset view that links ownership, criticality, exposure, and controls.
Explore solutionReady for the next step?
Turn this need into a practical assessment and clear implementation plan.
Share your use case and priority systems so we can discuss a pilot and its integration requirements.