Network Access Control (NAC)

Applies to. NAC is a technology choice, not a PCI DSS term of art: the standard expands the acronym and names it once, in the guidance to 11.2.1, as one of the methods for detecting unauthorised wireless access points. Where it otherwise applies is Requirement 1. A NAC system that drops a device into a restricted segment, or refuses it entirely, based on who or what it is acts as a network policy enforcement point, which is what makes something an NSC; that brings its policy under the ruleset standard, change control and six-monthly review in 1.2.1, 1.2.2 and 1.2.7. NAC is also one practical way to keep unknown devices off the segments that carry the CDE.

Example. A merchant's store network has payment terminals, staff laptops and a guest wireless network on the same switches. NAC checks each device as it connects: known terminals go to the payment VLAN, staff laptops with current patches go to the office VLAN, and everything else lands on the guest network with no route to the CDE. Because that policy decides what can reach the CDE, it needs the same documented standard and periodic review as any other NSC ruleset under 1.2.1 and 1.2.7.

Limits. NAC is not an account control, despite the name. Requirement 8 governs user accounts and authentication; NAC governs the device's place on the network. It is also not segmentation on its own: putting a device in a VLAN only isolates it if an NSC between VLANs actually denies the traffic. NAC does not replace the NSC between trusted and untrusted networks that 1.4.1 requires. And the acronym is easy to confuse with NSC: NSC is what the standard requires; NAC is one category of technology that can play that role.