NAC is inherently a multi-vendor problem. Assessment needs to work with all the different endpoints connected to your network:PCs, Macs, printers, phones, security cameras, etc. Evaluation needs to know what’s normal for each of those kinds of endpoints. And enforcement needs to work with whatever enforcement mechanism you want to use, preferably leveraging the network equipment you already have in place.

Because of NAC’s multi-vendor nature, everyone now agrees that we need NAC standards. Every endpoint should implement a standard NAC protocol so that its health can be checked as necessary, in accordance with local policies and regulations.

However, the world of NAC standards is complex and evolving. In my next few posts, I’ll give you a guided tour of the world of NAC standards.

How do I know so much about this? NAC standards is my job. I work on this full time. I’m co-chair of both the NAC standards committees: TCG TNC and IETF NEA. So I know what’s up in this area and I’m glad to explain it.