Network access control (NAC) is software that checks each device before it is allowed onto a company's network, and decides which part of the network the device may join. The device may be a laptop, a phone, a printer, a camera or a machine on a factory floor. NAC checks it whether it connects by cable or by Wi-Fi.
When a device connects, the network switch or the Wi-Fi access point does not let it in straight away. It first asks the NAC server about the device. The NAC server asks three questions. Who is the user? It checks the user's login against the directory, the master list of users and computers. Is the device healthy? It asks unified endpoint management (UEM), or a small endpoint agent on the device, whether the device has its security updates and its antivirus switched on. What kind of device is it? A printer or a camera has no user. NAC recognises such a device from its hardware address and from how it behaves on the network.
Then NAC places the device in one part of the network. Large networks are divided into separate virtual networks, called VLANs. Each VLAN can reach only certain systems.
Take, for example, an engineering college in Vellore with 9,000 students. On the first day of term, students connect thousands of phones and laptops to the campus Wi-Fi. A student logs in with her college account. NAC checks the account and places her laptop on the student network. That network reaches the internet and the library, but not the examination server. A professor's laptop is placed on the staff network. A visitor gets the guest network, which reaches only the internet. One student's laptop has had its antivirus switched off for two months. NAC places it on a quarantine network, which can reach only an update website, until the antivirus is switched on again. A new CCTV camera has no user at all. NAC recognises it as a camera and lets it reach only the video recorder.
Why does this matter? Without NAC, anyone who plugs a laptop into a wall socket in a meeting room is inside the network. NAC applies the idea of zero trust to the moment of joining: being in the building is not enough.
Factories and hospitals have many devices that cannot run any security software, such as pumps and controllers. Finding and controlling these devices is the job of OT and IoT security, which grew from the same idea. Some NAC makers also sell the SD-WAN that connects branch offices.