Device is assessed before being granted access (OS patches, antivirus status, compliance) 2. **Post-admission** — Device behavior is monitored after admission; non-compliant devices are quarantined 3. **802.1X** — Port-based authentication ensures only authorized devices connect