Network access control

Expanded Definition

Network access control, or NAC, is the policy layer that decides whether a device can join a network segment, and under what conditions. In NHI security, that decision often depends on device posture, certificate trust, identity assurance, and compliance state, not just a user prompt or a MAC address. NAC is related to NIST SP 800-207 Zero Trust Architecture because both shift access decisions toward continuous verification, but NAC is specifically concerned with admission to the network path rather than authorization to a specific application or secret. Definitions vary across vendors when NAC is bundled with endpoint compliance, segmentation, or guest access workflows, so the operational scope should be stated explicitly in policy and architecture documents.

For NHI programs, NAC is most useful when device identity and workload identity need to be evaluated together, such as when an agent, appliance, or service endpoint must first prove it is trusted before it reaches internal services. The most common misapplication is treating NAC as a substitute for application-layer authorization, which occurs when teams assume network admission alone is sufficient to control what an admitted device can do.

Examples and Use Cases

Implementing NAC rigorously often introduces onboarding friction for legitimate devices, requiring organisations to weigh tighter admission control against operational speed and support overhead.

• A CI/CD runner is allowed onto a build network only after presenting a valid certificate and passing posture checks, reducing exposure if the runner image is altered.
• An enterprise IoT gateway is quarantined until it meets firmware and configuration requirements, limiting lateral movement from unmanaged hardware.
• A contractor laptop receives restricted network access until endpoint monitoring confirms it is encrypted and patched, then is placed into a segmented guest zone.
• A service appliance accessing internal APIs is admitted only when its device identity matches approved inventory and its network posture aligns with policy.
• The 52 NHI Breaches Analysis shows how weak identity and access boundaries can magnify compromise when connected assets are not tightly governed, while the OWASP Non-Human Identity Top 10 helps frame the risks that NAC must support rather than replace.

NAC is also common in environments that separate production, staging, and third-party access zones, where admission policy becomes a control point for reducing unnecessary reach into sensitive network paths.

Why It Matters in NHI Security

NAC matters because many NHI incidents begin with a device, appliance, or automation endpoint reaching the network before anyone confirms whether it should be there. Once connected, that endpoint may expose secrets, call internal APIs, or serve as a pivot point for lateral movement. NHI Mgmt Group reports that 97% of NHIs carry excessive privileges, which means a compromised connected device can quickly turn network admission into broad operational access if downstream controls are weak. NAC helps contain that risk by forcing an explicit trust decision at the boundary, particularly when paired with certificate-based identity, segmentation, and revocation workflows described in the Ultimate Guide to NHIs and its standards section.

The control becomes even more important because 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, and NAC is often the first enforcement point for that strategy. Organisations typically encounter the need for NAC only after an unmanaged device or abused service endpoint is discovered on the internal network, at which point access admission, quarantine, and revocation become operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is the difference between OT network segmentation and identity-based access control?
• What is the difference between Kubernetes network policy and identity-based access control?
• Effective Access
• What is the difference between network controls and identity controls for infrastructure access?