What is NAC?
Network Access Control (NAC) is a security solution that identifies every device or user connecting to the network, checks whether that device complies with policy and then grants, restricts or denies access accordingly. NAC is therefore a form of access control at network level: the switch port or Wi-Fi access point only opens after authentication and authorisation. In OT environments, NAC keeps unknown laptops, rogue devices and infected equipment out of the industrial network without putting the availability of the process at risk.
🧠 What does NAC actually do?
A NAC solution goes through the same five steps for every connection:
- Identify - who or what is trying to connect: a user, a certificate, a MAC address or a recognised device type.
- Check posture - does the device comply with policy, for example an active antivirus product, current patches or the right firmware? This works mainly for Windows laptops and engineering workstations; a PLC cannot run a posture agent.
- Authorise - based on identity, role (RBAC) and device profile, the policy server decides which rights the device receives.
- Assign or block - the device is placed in a specific VLAN, receives an access control list (ACL), or ends up in a quarantine network.
- Monitor - NAC keeps tracking the device after it has connected. If its behaviour or status changes, the policy server can adjust or end its access mid-session.
🔧 How does NAC work technically?
Most NAC solutions are built on the 802.1X standard (IEEE Port-Based Network Access Control). It defines three roles:
| Role | What it is | Example in OT |
|---|---|---|
| Supplicant | Software on the device requesting access | Engineering laptop or Engineering Station with a certificate |
| Authenticator | Network device that opens or closes the port | Industrial switch or Wi-Fi access point |
| Authentication server | Central server that makes the decision | RADIUS server or NAC policy server |
EAP over LAN (EAPOL) runs between the device and the switch; the switch relays the request to the RADIUS server (UDP port 1812). EAP-TLS with device certificates is the strongest method and requires sound certificate management. The current edition is IEEE 802.1X-2020, which also covers key agreement for MACsec encryption (IEEE 802.1AE).
Many OT devices have no supplicant. For them there is MAC Authentication Bypass (MAB): the switch learns the MAC address from the first packet and asks the RADIUS server whether that address is on the approved list. With RADIUS Change of Authorization (CoA, RFC 5176, UDP port 3799) the policy server can re-authenticate a running session, move it to another VLAN or disconnect it after the fact.
NAC also profiles devices: using DHCP options, LLDP/CDP, the vendor prefix in the MAC address and traffic patterns, it recognises a PLC, an HMI, a SCADA server or an IoT sensor.
🏭 Why is NAC in OT different from IT?
NAC grew up in office networks, where IT mainly manages laptops and phones. A production environment plays by different rules:
| Aspect | IT network | OT network |
|---|---|---|
| Devices | Laptops and phones with an 802.1X supplicant | PLCs, I/O, drives and sensors without a supplicant |
| Posture check | Agent checks patches and antivirus | Usually impossible; identity via MAB and profiling |
| Profiling | Active scanning is common | Preferably passive via Passive Monitoring; active scans can disrupt fragile controllers |
| Changes | Devices come and go daily | Fixed configuration, changes via change management |
| Impact of a mistake | A user cannot work | Process disruption, downtime or a safety risk |
| Blocking | Immediate quarantine is acceptable | Alert first, block automatically only on edge ports |
The core rule in OT: a NAC decision must never interrupt a running process. That is why fixed controllers are usually registered in advance, and NAC enforces mainly on the ports where maintenance and supplier laptops are plugged in. Design the policy around risk profiles, such as fixed process equipment, in-house engineering laptops and suppliers. Suppliers receive temporary, logged guest access to only the segment they need.
🔐 Which risks does NAC cover, and which does it not?
| Risk without NAC | Consequence | What NAC does |
|---|---|---|
| Uncontrolled access | Laptops with malware connect freely to the control network | Unknown devices go to quarantine or a guest network |
| Shadow IT | Routers, Wi-Fi dongles and IoT gateways outside management | Detects and reports new devices |
| Malware spread | No way to isolate suspicious systems | Dynamic disconnection via CoA |
| Incomplete inventory | Unknown assets, unknown vulnerabilities | Feeds the Asset Inventory |
NAC also has limits. MAB can be bypassed through MAC spoofing: anyone who copies the address of a registered PLC gets the same access. NAC therefore does not replace network segmentation or firewalls between zones, nor physically locking cabinets and switch ports. Combine it with port security and anomaly detection to spot spoofed devices.
🧭 How do you introduce NAC step by step in an OT environment?
- Inventory first - use asset discovery and passive monitoring to map which devices sit on which port.
- Start in monitor mode - NAC logs and profiles but blocks nothing, so you can see which devices would fail.
- Move to low-impact mode - time-critical traffic such as DHCP is allowed before authentication; only the rest is restricted.
- Tune the timers - by default a Cisco switch waits three times 30 seconds (90 seconds) for 802.1X before falling back to MAB. That is too long for devices that must communicate immediately after a restart; choose MAB-first or shorter timers and test the result.
- Plan for failure - decide what happens when the RADIUS server is unreachable. In OT the usual choice is fail-open to a critical VLAN, so an outage of the NAC server does not stop production.
- Enforce in phases - start enforcing on ports for suppliers and remote access, then office and engineering zones, and only last the control network itself.
- Link to monitoring - send NAC events to the SIEM and let the firewall apply dynamic rules based on NAC status.
🔄 How does NAC fit standards and legislation?
- IEC 62443 - IEC 62443-3-3 requires authentication of devices and software processes (SR 1.2) and a component inventory (SR 7.8) from Security Level 2 upwards. NAC is a practical way to demonstrate both, including within the zones and conduits model.
- NIS2 and the Dutch Cybersecurity Act - Article 21 of NIS2 lists access control policies and asset management as a duty-of-care measure. The Dutch Cyberbeveiligingswet entered into force on 15 August 2026.
- ISO 27001 - the Annex A controls for network security and access control can be supported with NAC.
- Zero Trust - NAC supplies the device identity and status on which zero-trust decisions rely; it is one building block, not the whole architecture.
None of these frameworks prescribes a NAC product; they require demonstrable control over who and what is on the network.
❓ Frequently asked questions
What is the difference between NAC and 802.1X?
802.1X is the IEEE standard for port-based access control between a device, a switch and an authentication server. NAC is the broader solution that uses 802.1X but adds profiling, posture checks, guest management, MAB and dynamic enforcement.
Does NAC work with PLCs that do not support 802.1X?
Yes, for PLCs without a supplicant NAC usually relies on MAC Authentication Bypass combined with device profiling. Because a MAC address can be forged, this should be backed up by additional monitoring such as anomaly detection and port security.
Can NAC bring production to a halt?
A misconfigured NAC can disconnect a controller from the network, for example after a restart or when the RADIUS server fails. That is why an OT rollout starts in monitor mode, with fail-open settings and enforcement on edge ports first.
What is MAC Authentication Bypass?
MAC Authentication Bypass (MAB) is a fallback method in which the switch presents a device’s MAC address to the RADIUS server instead of performing 802.1X authentication. MAB is intended for devices without a supplicant, such as printers, cameras and many OT components.
Is NAC mandatory under NIS2?
NIS2 and the Dutch Cybersecurity Act do not prescribe a specific product, but they do require access control policies and asset management. NAC is a common way to demonstrate that only known and authorised devices get onto the network.
Which vendors offer NAC?
Well-known NAC platforms include Cisco ISE, HPE Aruba Networking ClearPass, Forescout and Fortinet FortiNAC. For OT, what matters most is that the platform can profile passively and recognises industrial protocols.
📌 In summary
Network Access Control (NAC) is the digital gatekeeper of your network: for every connection it decides who or what is connecting, under which conditions and with which rights. In OT, NAC uses 802.1X where possible and MAB with profiling where necessary, introduced in phases so that security never comes at the expense of process availability.