How to Build a Business Case for NAC (Network Access Control)

You have a customer who knows they need Network Access Control. Their CISO agrees. Their network team agrees. The security assessment found gaps. The pen test showed lateral movement. Everyone in the room nods when you describe the value of NAC.

Then the project dies in procurement.

NAC is one of the most technically justified and commercially stalled security technologies in the market. The gap between “we need this” and “we are buying this” is where most NAC deals go to die. This guide gives you the framework to bridge that gap by building a business case that speaks to CISOs and CFOs in their own language.

Why NAC Projects Stall

Before building the business case, understand why it needs to be built in the first place. NAC faces three systemic challenges in the sales cycle.

Challenge 1: The Budget Problem

NAC is not cheap. A production Cisco ISE deployment includes licensing (per-endpoint), hardware or virtual appliance infrastructure, professional services for design and deployment, and potentially switch upgrades for 802.1X support. The total cost for a mid-size enterprise can range from $200K to $500K or more.

That number competes with every other security project on the CISO’s roadmap. XDR, SASE, cloud security, and identity governance all fight for the same dollars. NAC often loses because it is perceived as an infrastructure project rather than a strategic security initiative.

Challenge 2: The Complexity Perception

NAC has a reputation problem. Organizations that attempted NAC deployments five or ten years ago remember painful experiences: broken RADIUS configurations, printers going offline, VoIP phones losing connectivity, and weeks of troubleshooting. The technology has matured significantly since then, but the institutional memory persists.

Decision-makers who remember those experiences carry that trauma into current evaluations. They hear “NAC” and think “six months of break-fix” rather than “automated device visibility and policy enforcement.”

Challenge 3: Competing Priorities

NAC does not generate the same executive excitement as AI-driven threat detection or cloud-native security platforms. It is foundational — like plumbing. Essential, but not something the board discusses in quarterly reviews.

The result is that NAC gets deprioritized in favor of projects with more visible outcomes, even when the risk analysis clearly supports NAC as the higher-priority investment.

The ROI Framework

A compelling NAC business case quantifies value across four categories. Every number should be defensible, sourced, and specific to the customer’s environment when possible.

Category 1: Risk Reduction

NAC directly reduces the probability and impact of a breach by controlling what connects to the network, segmenting access, and limiting lateral movement.

Key metrics to quantify:

• Breach probability reduction. Organizations with NAC reduce their attack surface by controlling unauthorized device access. According to Ponemon Institute data, network segmentation reduces breach costs by an average of $250,000. NAC is the enforcement mechanism for segmentation.

• Lateral movement containment. Without NAC, a compromised endpoint can reach every other device on the same VLAN or subnet. With NAC, devices are dynamically segmented based on identity, type, and posture — limiting the blast radius of any single compromise.

• Unauthorized device blocking. The average enterprise network has 30-40% more connected devices than IT is aware of. IoT devices, personal devices, contractor laptops, and rogue access points all represent unmanaged risk. NAC profiles and controls every device.

Calculation example:

Annual breach probability (industry average): 25-30%
Average breach cost (IBM 2024): $4.88M
Expected annual breach loss: $1.22M - $1.46M

NAC risk reduction factor: 30-50% (conservative estimate for 
segmentation + unauthorized device blocking)

Expected annual risk reduction: $366K - $732K

Category 2: Compliance Savings

NAC addresses requirements across multiple compliance frameworks. Without NAC, organizations meet these requirements through manual processes that are expensive and error-prone.

PCI DSS 4.0 requirements addressed by NAC:

• Requirement 1: Network segmentation between cardholder data environment (CDE) and general network
• Requirement 7: Restrict access to system components by business need-to-know
• Requirement 9: Restrict physical access to cardholder data (network port security)

NIST CSF controls addressed by NAC:

• PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited
• PR.AC-3: Remote access is managed
• PR.AC-5: Network integrity is protected through segmentation

HIPAA requirements addressed by NAC:

• Access Control (164.312(a)): Technical policies and procedures for access to ePHI
• Audit Controls (164.312(b)): Hardware, software, and procedural mechanisms to record access

Compliance cost savings calculation:

Annual audit remediation (manual network access documentation): $50K-150K
Potential PCI DSS non-compliance fines: $5K-100K/month
Potential HIPAA violation fines: Up to $1.5M per violation category
Annual compliance staff time (manual access reviews): $80K-120K

NAC automation savings: 60-80% reduction in manual compliance effort
Annual compliance savings estimate: $100K-300K

Category 3: Operational Efficiency

NAC automates processes that are currently manual, time-consuming, and error-prone.

Device onboarding: Without NAC, provisioning a new device on the network requires a help desk ticket, a network engineer to configure a switch port, and manual VLAN assignment. With NAC, devices are automatically profiled, authenticated, and placed in the correct segment based on policy. Average time savings: 30-60 minutes per device.

Guest access management: Without NAC, guest access typically involves shared Wi-Fi passwords (insecure) or manual guest account creation by IT staff. With NAC, guest portals allow self-service registration with automatic time-limited access and network isolation. Average time savings: 15-20 minutes per guest.

Incident investigation: Without NAC, determining which devices were on the network at the time of an incident requires correlating DHCP logs, switch MAC address tables, and authentication logs across multiple systems. With NAC, full session history — who connected, when, from where, on which device — is available in a single console. Average investigation time reduction: 2-4 hours per incident.

Operational efficiency calculation:

New devices onboarded per month: 50-200
Time saved per device: 30 minutes
Monthly onboarding savings: 25-100 hours

Guest registrations per month: 100-500
Time saved per guest: 15 minutes  
Monthly guest management savings: 25-125 hours

Security incidents investigated per month: 5-20
Time saved per investigation: 3 hours
Monthly investigation savings: 15-60 hours

Total monthly time savings: 65-285 hours
Annual FTE equivalent savings: 0.4-1.7 FTEs
Annual cost savings (at $80/hr loaded rate): $62K-274K

Category 4: Insurance Premium Impact

Cyber insurance carriers increasingly require NAC or equivalent network segmentation controls as conditions for coverage. Customers who cannot demonstrate these controls face:

• Premium increases of 20-50% at renewal
• Higher deductibles
• Exclusions for claims related to unauthorized device access
• Potential coverage denial

Insurance impact calculation:

Current annual cyber insurance premium: $100K-500K (varies by industry/size)
Expected premium increase without NAC controls: 20-30%
Annual premium increase avoided: $20K-150K

Deductible reduction with NAC controls: 10-25%
Potential savings per claim: $25K-250K

Building the Cost Model

The ROI framework shows the benefits. The cost model shows the investment. Together, they form the business case.

Solution Costs

Licensing (Cisco ISE example):

• Base license: Device visibility, profiling, and basic authentication
• Plus license: Adds posture assessment, guest services, and BYOD
• Advantage license: Adds third-party integrations, pxGrid, and advanced features
• Licensing is per concurrent endpoint session, tiered by volume

Infrastructure:

• ISE appliances (physical or virtual) — typically 2-4 nodes for redundancy
• Switch upgrades — older switches may require firmware updates or hardware replacement for 802.1X support
• Wireless controller configuration — if not already configured for 802.1X
• Certificate infrastructure — PKI for EAP-TLS if not already in place

Professional services:

• Network assessment and design (2-4 weeks)
• ISE deployment and configuration (4-8 weeks)
• Policy design and phased enforcement (4-8 weeks)
• Knowledge transfer and documentation (1-2 weeks)
• Total services typically represent 30-50% of project cost

Ongoing costs:

• Annual license renewal (SmartNet or subscription)
• Ongoing administration (0.25-0.5 FTE for mid-size deployment)
• Periodic policy review and optimization

The Cost Comparison Table

Present this side-by-side comparison in the business case:

The 3-Slide Business Case Template

Most executives will not read a 20-page business case. They need three slides that tell the story in under five minutes.

Slide 1: The Problem

Title: “We Cannot See or Control 40% of Devices on Our Network”

Content:

• Current state: [X] known managed devices, estimated [Y] unknown/unmanaged devices
• No automated enforcement: any device can connect to any port or SSID
• Compliance gap: [Framework] requires network segmentation and access control
• Recent pen test finding: lateral movement from guest network to production systems
• Insurance carrier requiring network access controls at next renewal on [date]

Visual: Network diagram showing managed vs. unmanaged devices, with arrows indicating unrestricted lateral movement.

Slide 2: The Solution

Title: “NAC Provides Visibility, Control, and Compliance in a Single Platform”

Content:

• Automated device discovery and profiling — see every device on the network
• Policy-based access control — right device, right access, right segment
• Guest and BYOD management — self-service, time-limited, isolated
• Compliance automation — continuous enforcement with audit-ready reporting
• Phased deployment — monitor-only mode first, enforcement after validation

Visual: Before/after architecture showing flat network vs. segmented network with NAC enforcement points.

Slide 3: The ROI

Title: “NAC Pays for Itself in [X] Months Through Risk Reduction and Operational Savings”

Content:

• 3-year total cost of ownership: $[amount]
• 3-year total risk reduction and savings: $[amount]
• ROI: [X]% over 3 years
• Payback period: [X] months
• Additional benefits: insurance compliance, audit readiness, incident investigation speed

Visual: Bar chart comparing 3-year cost vs. 3-year benefit with payback period marked.

Getting CISO and CFO Alignment

The CISO and CFO care about different things. Your business case must address both perspectives simultaneously.

What the CISO Cares About

• Risk reduction. How does NAC reduce the probability and impact of a breach? Map NAC capabilities to MITRE ATT&CK techniques that NAC mitigates (initial access via rogue devices, lateral movement, credential-based attacks on network infrastructure).

• Compliance. Which specific audit findings or framework gaps does NAC close? If the organization has open audit findings related to network segmentation or access control, NAC is the remediation.

• Visibility. Most CISOs will tell you their biggest problem is not knowing what is on the network. NAC’s profiling engine provides a complete device inventory — which is valuable even before enforcement begins.

• Integration. How does NAC fit with the existing security stack? ISE integrates with SIEM (syslog/pxGrid), SOAR (API/pxGrid), EDR (posture assessment), and firewalls (SGT/TrustSec). Show the CISO that NAC enhances their existing investments rather than creating another silo.

What the CFO Cares About

• Total cost of ownership. Not just the sticker price — include implementation, training, ongoing administration, and renewal costs over three to five years.

• Risk quantification. Translate breach probability and impact into dollar amounts. CFOs understand expected annual loss calculations.

• Payback period. How many months until the investment pays for itself through risk reduction, compliance savings, and operational efficiency?

• Cash flow. Can the project be phased to distribute costs across quarters or fiscal years? Subscription licensing models are often easier to approve than large upfront capital expenditures.

• Comparison to alternatives. What happens if we do nothing? What does the do-nothing scenario cost in terms of ongoing compliance effort, insurance increases, and breach exposure?

Alignment Strategy

The most effective approach is a joint meeting where the CISO presents the risk justification and the SE presents the solution and ROI. This avoids the common failure mode where the CISO builds a business case independently and the CFO questions the financial assumptions.

Prepare the CISO with the financial data. Prepare the CFO with enough technical context to understand why the risk is real. Bridge the gap by presenting a single business case that addresses both perspectives.

POC to Production: The Timeline

A common failure mode in NAC sales is the indefinite POC. The customer runs a proof of concept, validates the technology, and then stalls before purchasing. Define the timeline upfront.

Recommended Timeline

Weeks 1-4: POC

• Deploy ISE in a lab or scoped production environment
• Profile devices and validate visibility
• Configure basic authentication policies
• Test guest portal and BYOD onboarding
• Document findings and success criteria results

Weeks 5-8: Business Case and Procurement

• Present POC results to CISO and CFO
• Finalize the business case with real data from the POC
• Begin procurement and contract negotiation
• Scope the production deployment (phased approach)

Months 3-5: Phase 1 Production Deployment

• Deploy ISE production infrastructure (PSN, MnT, PAN nodes)
• Enable monitor mode across Phase 1 sites
• Profile all devices and build policy exceptions
• Begin authentication enforcement (802.1X, MAB)
• No devices blocked — monitor and refine

Months 5-8: Phase 2 Enforcement

• Enable authorization policies (segmentation, posture)
• Expand to remaining sites
• Automate guest and BYOD workflows
• Integrate with SIEM and SOAR

Months 8-12: Full Production and Optimization

• All sites under NAC enforcement
• Policy optimization based on operational data
• Knowledge transfer to operations team
• Transition to steady-state operations

Setting Expectations

Be transparent with the customer about what is realistic:

• Monitor mode first. NAC should never go directly to enforcement. Start in monitor mode to build the device inventory and refine policies without impacting production traffic.

• Exceptions are normal. Every network has devices that do not behave as expected — old printers, medical devices, building automation systems, legacy applications. Plan for an exception handling process.

• Phased sites. Do not attempt to deploy to all sites simultaneously. Start with a headquarters or campus, validate, then expand. Lessons learned at the first site dramatically accelerate subsequent deployments.

• Staff training. The customer’s network and security teams need training on ISE administration. Build knowledge transfer into the project plan. A NAC deployment that only the vendor can manage is a deployment at risk.

Common Objections to the NAC Business Case

Even with a strong ROI, expect pushback. Here is how to handle it.

“NAC is too complex to deploy.” Acknowledge the historical complexity, then present the phased approach: monitor mode requires no network changes and provides immediate visibility value. Enforcement is gradual and controlled. Modern ISE deployments are significantly more streamlined than legacy NAC.

“We can segment the network manually with VLANs.” Manual VLAN segmentation is static, does not scale, and requires network engineering effort for every change. NAC provides dynamic, policy-based segmentation that adapts in real-time based on device identity, type, and posture. Ask how many hours their network team currently spends on VLAN management.

“Our switches are too old.” This is a legitimate concern. Conduct a switch inventory during the POC scoping phase. Many older switches support MAB (MAC Authentication Bypass) even if they do not support full 802.1X. A hybrid approach — 802.1X on capable switches, MAB on legacy — provides coverage while the switch refresh occurs on its own timeline.

“We already have device visibility through our CMDB.” A CMDB is a static inventory. It tells you what should be on the network, not what actually is. NAC provides real-time, dynamic visibility of every connected device — including the ones not in the CMDB. The gap between CMDB records and NAC profiling data is often the most compelling POC finding.

The Business Case Checklist

Use this checklist when building a NAC business case for any customer:

• Quantify the number of managed and unmanaged devices on the network
• Identify compliance frameworks that require network segmentation or access control
• Document recent pen test or audit findings related to network access
• Calculate breach cost exposure using industry data and customer-specific factors
• Build the four-category ROI model (risk, compliance, operations, insurance)
• Estimate total cost of ownership over three years (licensing, infrastructure, services)
• Calculate payback period and net annual benefit
• Build the 3-slide executive presentation
• Prepare CISO-specific and CFO-specific talking points
• Define the POC scope and success criteria
• Map the POC-to-production timeline with milestones
• Identify potential switch compatibility issues early
• Confirm cyber insurance carrier requirements for network access controls

The business case is not just a sales document — it is a decision-making tool for your customer. When built correctly, it gives the CISO the ammunition to justify the project and the CFO the confidence to fund it. Your role as the SE is to provide the technical credibility and financial modeling that makes the decision easy.

Related Posts in This Series

• Cisco ISE vs Aruba ClearPass vs Forescout — Compare the NAC platforms the business case will justify
• Running a Cisco ISE POC: Timeline, Scope, and Gotchas — Plan the POC that proves the business case assumptions
• Security Compliance Cheat Sheet: NIST, ISO 27001, SOC 2, PCI DSS — Link NAC investment to compliance requirements the CFO cares about
• Network Segmentation Pitch — Position NAC as the enforcement engine for network segmentation
• Handling the 5 Most Common Security Objections — Overcome budget and priority objections during the business case presentation