Network Access Control (NAC) is a set of technologies that decide whether a device is allowed to join a network and what it may reach once connected, based on the device identity and its security posture.
A NAC deployment often uses 802.1X to authenticate devices at the switch port or wireless controller, then runs posture checks such as patch level, disk encryption, or whether antivirus is present and current. A laptop that fails those checks can be dropped into a quarantine or remediation VLAN with limited access until it is brought into compliance, rather than being placed straight onto the production network.
The awkward cases are the ones to watch. Printers, IoT sensors, and other devices that cannot run a posture agent need exceptions, and those exceptions are exactly where attackers look. Unmanaged physical ports and personal BYOD hardware also strain the model, so NAC works best paired with segmentation.
Why does NAC matter for the CISSP exam?
It lives in Domain 4, Communication and Network Security, which makes up 13% of the exam. Connect it to 802.1X, endpoint posture assessment, and the principle of admitting devices to the network only after they prove who they are and that they are healthy.