Decide who gets on the network, and what they reach.

It depends on the estate. ISE is the natural fit where the network is already Cisco and the client wants TrustSec segmentation and deep integration with the wider Cisco security stack. ClearPass is genuinely multi-vendor and often the better choice on mixed or Aruba switching, with strong agentless profiling out of the box. We design for whichever serves the client, not whichever we prefer to sell, and we deploy Forescout alongside either one when device visibility is the priority.

Agentlessly. A camera, badge reader or infusion pump will never run a supplicant, so we profile it instead: ISE, ClearPass and Forescout fingerprint each device by its behaviour, DHCP signature and traffic pattern, then place it on a segment scoped to exactly what it needs to talk to. The result is a live inventory of the unmanaged estate and a policy per device class, with no software touching the device.

Not the way we run it. Every deployment starts in monitor mode, which authenticates and logs every endpoint but denies nothing, so we can see the full picture, fix the stragglers and tune policy against real traffic. Only once the estate is clean do we move to enforcement, segment by segment. The phased path is the whole point: visibility first, enforcement second, no Monday-morning outage.

Your client's team does, or your team under your brand. We design, deploy, tune and validate the platform, then hand it over with the policy model, the runbooks and the knowledge transfer to operate it. Belico builds and hands over on a project basis; we are not a managed service and we do not run the platform on an ongoing contract. If you offer NAC operations under your own brand, we are happy to be the engineering behind it.

Directly. NIS2 Article 21 expects network segmentation and access control as baseline cyber hygiene, and a NAC plus segmentation build is the clearest way to evidence it. We package the segmentation architecture, the policy matrix and the enforcement evidence so the control is auditable rather than asserted, and the same artefacts support Cyber Essentials and ISO 27001.

Yes, and that makes the project faster. If wired and wireless 802.1X is already in place, the heavy lifting of supplicant configuration is largely done, so we extend it into full NAC: profiling for the devices that cannot do 802.1X, posture checks on the ones that can, dynamic segmentation policy, and guest and BYOD flows. We meet the estate where it is rather than starting from a blank slate.