The rollout of NAC to all company employees is ongoing, with deployment to sites in the Americas nearly complete, he says. The company is coordinating with sites in Europe and Asia to prepare them for the installation. "Historically, we let those companies work independently, if you will," he says. So imposing a global security policy like NAC requires some groundwork and diplomacy.

Estee Lauder is also coordinating downtimes that the deployment will cause to coincide with deployment of other network upgrades, including the implementation of SAP, Correia says.

The firm already used NAC to check the machines used by about 3,000 consultants that needed network access.

Scanning machines takes about 30 seconds each, and Estee Lauder uses all three options offered for doing that: a full NAC client, downloadable agents and clientless. For all company-managed machines, it uses the full client because that creates a single deployment method that is relatively simple to carry out. The client has become part of the standard-issue desktop software image, Correia says.

Users' attempts to acquire an IP address are intercepted by the StillSecure server, the machines are scanned and if they are compliant, the NAC server does an IP renew on behalf of the client, he says. The scan is repeated periodically after machines have been admitted to the network.

If a machine fails compliance, the NAC gear displays on the user machine a message about how to remediate the problem.

The NAC has been turned on first in monitor mode to set a baseline for compliance, and warning users to bring their machines into compliance. NAC is finding users who have turned off their antivirus software.

NAC acts as a backup confirmation of other tools, such as McAfee's ePolicy Orchestrator server, which pushes antivirus updates and gathers security data. In return, ePolicy Orchestrator can report shortcomings that it finds to the StillSecure gear, which can then quarantine offending machines until they are fixed to meet requirements, he says.

"We can use Safe Access to validate against our other validation tests," he says.