NAC and Network Segmentation for Federal Zero Trust: Meeting CISA and DoD Mandates

Zero trust stopped being a buzzword for federal agencies the moment it became a mandate. Executive Order 14028, OMB Memorandum M-22-09, the CISA Zero Trust Maturity Model (ZTMM), and the DoD Zero Trust Strategy all converged on the same premise: no user and no device gets implicit trust because it sits inside the network perimeter. Every connection must be authenticated, authorized, and continuously verified. For network and security teams at federal civilian agencies, the DoD, and state, local, and education (SLED) organizations, that requirement lands squarely on two technologies that have to work together: Network Access Control (NAC) and network segmentation.

This is the keystone guide to how those pieces map to the mandates. We will walk through network access control compliance as the identity and device pillars of zero trust, segmentation as the network pillar, and extended detection and response as the cross-cutting visibility and analytics layer. The goal is to give procurement leads and architects a defensible mental model for how Cisco Identity Services Engine (ISE) and Cisco XDR satisfy CISA and DoD zero trust requirements, and what to confirm before you buy.

Why Zero Trust Mandates Put NAC at the Center

The pre-zero-trust network treated the LAN as a trust boundary. Once a device reached a switchport, it was implicitly trusted to talk to anything its IP routing allowed. Both the CISA ZTMM and the DoD Zero Trust Strategy explicitly reject that model. They require continuous identification of every user and device, least-privilege access scoped to need, and the ability to revoke or restrict access dynamically when context changes. NAC is the enforcement mechanism that makes those policy statements real at the network port. It answers three questions before any traffic flows: who is this user, what is this device, and is it healthy enough to be here.

Cisco delivers NAC through ISE, which Cisco positions as the bedrock of zero trust. ISE acts as the policy decision point, authenticating every endpoint via IEEE 802.1X and RADIUS, profiling what each device actually is, checking its security posture, and then enforcing an access decision through the switch, wireless controller, or VPN headend. That decision can grant full access, push the device into a restricted VLAN, apply a downloadable ACL, or quarantine it outright. The detail that matters for compliance reviewers is that NAC is not a one-time gate. ISE continuously re-evaluates context and can issue a Change of Authorization (CoA) the moment a device falls out of compliance.

Mapping NAC to the CISA Zero Trust Identity and Device Pillars

The CISA Zero Trust Maturity Model is organized around five pillars (Identity, Devices, Networks, Applications and Workloads, and Data) plus three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, and Governance). NAC via Cisco ISE federal deployments maps most directly to the first two pillars, and an honest reading shows exactly where it contributes and where it hands off.

The Identity Pillar

ISE functions as a full RADIUS AAA server supporting the modern EAP methods agencies require, including EAP-TLS and TEAP, and it supports EAP chaining so a single authentication session can validate both the machine and the user. It integrates with Active Directory, Microsoft Entra ID, LDAP, and SAML 2.0 identity providers, and it includes an internal certificate authority with OCSP revocation. For DoD environments specifically, ISE supports administrator authentication via Common Access Card (CAC) and smart card. This is the identity pillar in practice: strong, phishing-resistant authentication bound to a verified identity store rather than a shared secret.

The Device Pillar

The device pillar requires that agencies maintain a complete inventory of authorized devices and assess each device's security posture before and during a session. ISE profiles and classifies every connected endpoint using predefined templates plus a cloud-based Multi-Factor Classification machine-learning engine that fingerprints unmanaged IoT, medical, and OT devices that cannot run a supplicant. Its posture assessment checks OS patch level, antimalware status, disk encryption, and more through Cisco Secure Client, with MDM and EMM posture queries to Microsoft Intune and Jamf for managed mobile fleets. Non-compliant devices are remediated or restricted automatically, which is precisely the continuous device-trust evaluation the ZTMM expects at its higher maturity stages.

Segmentation as the Network Pillar

Authenticating a device is necessary but not sufficient. The network pillar of both the CISA model and the DoD strategy demands that east-west traffic be controlled, that critical assets be isolated, and that lateral movement be constrained so a single compromised endpoint cannot pivot freely across the environment. This is where network segmentation compliance becomes a board-level concern, and where Cisco's approach diverges meaningfully from IP-based access lists.

ISE serves as the segmentation controller for Cisco TrustSec, defining policy with Security Group Tags (SGTs) rather than IP addresses or VLANs. Because an SGT travels with the user or device regardless of where it connects or what address it holds, policy stays consistent across campus switches, routers, wireless, and firewalls, and it survives IP changes. This enables both macro-segmentation (separating, say, a clinical network from a guest network) and micro-segmentation (limiting which workloads a single device class can reach). ISE also drives Cisco Software-Defined Access group-based policy through Catalyst Center, so the segmentation intent an architect defines once is propagated as a group-based policy matrix across the fabric.

Why SGT-based segmentation matters for compliance scope: Traditional segmentation tied to IP subnets and VLAN sprawl is brittle and hard to audit. Identity-based segmentation with Security Group Tags lets you express policy as 'medical devices may not initiate connections to the finance segment' instead of maintaining hundreds of ACL lines. That shrinks both the attack surface and the audit burden, because the policy reads the way the control objective reads.

XDR as the Visibility, Analytics, and Automation Layer

Zero trust is not only about gates and walls. The CISA model's cross-cutting capabilities (Visibility and Analytics, plus Automation and Orchestration) require that agencies collect telemetry across the environment, detect threats with analytics, and respond at machine speed. NAC and segmentation generate rich identity and network context, but something has to correlate that context into actionable incidents. That is the role of Cisco XDR for government SOC teams.

Cisco XDR is a cloud-native extended detection and response platform that natively analyzes the six telemetry sources SOC operators consider critical: endpoint, network, firewall, email, identity, and DNS. It correlates events over time into single prioritized incidents, scoring each from 1 to 1000 by combining a MITRE ATT&CK-based detection risk score with an analyst-assigned asset value. For federal threat-informed defense, that native MITRE ATT&CK mapping is significant: it lets a SOC demonstrate coverage against specific adversary techniques rather than counting raw alerts. The Attack Storyboard with Instant Attack Verification uses agentic AI to autonomously confirm whether an alert is a real attack, compressing what used to be hours of investigation into minutes, and it is included even at the Essentials tier.

Crucially for zero trust, XDR closes the loop with NAC. ISE shares identity and device context through pxGrid, and when XDR or another security tool detects a compromised endpoint, Rapid Threat Containment and Adaptive Network Control let ISE quarantine, bounce, or shut down that endpoint's access automatically. Detection at the analytics layer triggers enforcement at the network layer, which is exactly the automation and orchestration maturity the mandates ask agencies to reach.

How the Three Pillars Reinforce Each Other

The reason this trio is a keystone rather than three separate purchases is that each layer makes the others more effective. ISE authenticates and profiles, producing trustworthy identity context. TrustSec segmentation uses that context to constrain where each device can go. XDR ingests network, identity, and endpoint telemetry to detect what slips through, then hands a containment action back to ISE. Pull any one out and zero trust degrades: authentication without segmentation lets a trusted device roam; segmentation without analytics is blind to in-segment compromise; analytics without an enforcement point can detect but not contain.

• Identity and device pillars: ISE authenticates every user and device with 802.1X, profiles unmanaged endpoints, and checks posture continuously.
• Network pillar: TrustSec Security Group Tags and SD-Access enforce least-privilege segmentation that follows identity, not IP.
• Visibility and analytics: Cisco XDR correlates six telemetry sources into prioritized, MITRE-mapped incidents.
• Automation and orchestration: pxGrid and Rapid Threat Containment turn a detection into an automatic access change at the port.
• Governance: ISE policy sets and XDR incident records give auditors a documented trail of which identities were allowed where, and why.

Meeting Federal Certification and Compliance Requirements

For public-sector buyers, capability alone does not close a procurement. The product has to carry the right certifications, and the supply chain has to be compliant. This is where buyers should slow down and verify rather than assume. The diligence here protects both the network access control compliance posture you are buying and the audit trail you will have to defend later.

ISE certifications to confirm at quote time

Per Cisco documentation, ISE is designed to meet Federal Information Processing Standard (FIPS) 140 requirements (140-2 or 140-3 depending on the release) and Common Criteria against the Network Device Collaborative Protection Profile (NDcPP), and earlier ISE releases completed Unified Capabilities / DoDIN Approved Products List (APL) certification while that program was active. Release 3.5, generally available September 22, 2025, aligns with NDcPP v3.0e, supports a FIPS 140-3 mode, adds full single-stack IPv6 with USGv6 and IPv6 Ready logo certification planned, and continues to support CAC and smart-card administrator authentication. Cisco submitted 3.5 for DoDIN APL testing in the NAC category, but DISA sunset the APL program on September 30, 2025 and closed all testing by December 31, 2025, so treat any ISE APL entry as a certification the platform completed, not one it is pursuing. Certifications vary by release, so the exact certified version and its current status, published on Cisco's Global Government Certifications page, should be confirmed before you commit to a SKU.

FedRAMP and cloud considerations

ISE is not itself a FedRAMP-authorized cloud service, even though it can be deployed natively on AWS, Azure, and OCI, and on Google Cloud through VMware Engine, for hybrid architectures. For regulated and air-gapped environments, that is often an advantage: ISE runs on Cisco Secure Network Server appliances, which are available in TAA-compliant configurations confirmed per part number, or as a virtual machine entirely on-premises, so policy never leaves the agency's control. Cisco XDR is cloud-delivered and uses Cisco Security Cloud Sign On for user login, so buyers should verify the current FedRAMP authorization status per component on the FedRAMP Marketplace at the time of purchase. As of 2025 to 2026, several adjacent Cisco cloud services have achieved or are pursuing FedRAMP authorization, but you should never assume a specific XDR FedRAMP level or impact level without confirming the current authorization on the Marketplace.

Do not state certifications you have not verified: Certification posture changes release to release and quarter to quarter. The defensible practice is to specify the exact ISE release and XDR component in the order, then confirm its FIPS, Common Criteria, and FedRAMP status against the official Cisco and FedRAMP sources on the date of purchase. For DoDIN APL, which DISA sunset on September 30, 2025, check whether the platform completed certification while the program was active; DISA keeps the repository available through FY2026. An authorized partner can pull that current status for you so the contract reflects reality, not last year's datasheet.

DoD Zero Trust Strategy and the SLED and Healthcare Angle

The DoD Zero Trust Strategy frames its work around seven pillars and a set of target and advanced activities to reach by its milestone dates. NAC and segmentation feed directly into the User, Device, and Network/Environment pillars: continuous device authentication, comprehensive device inventory, software-defined enforcement, and macro/micro-segmentation are all named outcomes. ISE's profiling, posture, TrustSec segmentation, and CAC support line up with those activities, and XDR's correlation and automated response support the Visibility and Analytics and Automation and Orchestration pillars that span the strategy.

State, local, and education buyers face the same architecture even where the mandate language differs. SLED networks are dense with unmanaged devices, from classroom IoT to municipal OT, and grant-funded modernization increasingly carries zero-trust strings. Healthcare networks add connected medical devices that cannot run an agent and must be profiled and segmented to protect patient data and limit ransomware blast radius. In every case the pattern holds: profile the device with ISE, segment it with SGTs so it can only reach what it must, and watch the correlated telemetry in Cisco XDR so an infected infusion pump or smartboard cannot become a beachhead.

Procurement: TAA, GPC, and Contract Vehicles

Once the architecture is settled, the order still has to clear procurement rules. Federal and SLED buyers typically need Trade Agreements Act (TAA) compliant hardware, Government Purchase Card (GPC) eligibility for smaller buys, and the right contract vehicle for larger ones. As an authorized Cisco partner, Uniqcli scopes the compliant SKU set, the ISE licensing tier, and the XDR retention and ingestion sizing, then supplies Secure Network Server appliances in TAA-compliant configurations, confirmed per part number, through the purchase paths open to a direct reseller: GPC orders, simplified acquisition under FAR Part 13, FAR-based purchase orders, and WAWF/PIEE invoicing for DoD. Uniqcli does not currently hold a GSA Schedule or other contract vehicle, so if your agency must buy on a specific vehicle, say so early and we will tell you plainly whether we can help. You can review our federal procurement and contract-vehicle options to confirm eligibility before you build a requisition.

On licensing, ISE uses three nested, endpoint-count-based subscription tiers. Essentials covers core 802.1X NAC and guest access. Advantage adds profiling enforcement, TrustSec segmentation, BYOD, pxGrid context sharing, and Rapid Threat Containment. Premier adds posture and MDM enforcement plus Threat-Centric NAC. Device administration over TACACS+ is a separate, perpetually licensed add-on applied to the policy nodes running that persona. Because the tiers are nested and priced by endpoint count, the right scope depends on your device population and which zero-trust activities you need to satisfy, which is exactly the conversation a partner-led quote should resolve. When you are ready to size it, request a quote and we will model the tiers, retention, and hardware against your environment.

Next Step: Build Your Zero Trust Network Foundation

Federal, DoD, SLED, and healthcare buyers do not need to choose between compliance and capability. NAC supplies the identity and device pillars, TrustSec segmentation supplies the network pillar, and XDR supplies the visibility, analytics, and automation that tie zero trust together. The architecture is proven; the work is scoping it to your environment and confirming each component's certification status before purchase. Start with the network access control pillar to ground the design, then explore how Cisco ISE and the broader Cisco security portfolio fit your stack. When you are ready to turn the architecture into a compliant order, request a quote and our authorized-partner team will scope TAA-compliant hardware, the right licensing tiers, and GPC-eligible procurement for your agency.