AC-14 Permitted Actions Without Identification or Authentication

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	None

Related controls: AC-8, IA-2, PL-2

Control statement

• a. Identify [Assignment: organization-defined user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and
• b. Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication.

NIST discussion

Specific user actions may be permitted without identification or authentication if organizations determine that identification and authentication are not required for the specified user actions. Organizations may allow a limited number of user actions without identification or authentication, including when individuals access public websites or other publicly accessible federal systems, when individuals use mobile phones to receive calls, or when facsimiles are received. Organizations identify actions that normally require identification or authentication but may, under certain circumstances, allow identification or authentication mechanisms to be bypassed. Such bypasses may occur, for example, via a software-readable physical switch that commands bypass of the logon functionality and is protected from accidental or unmonitored use. Permitting actions without identification or authentication does not apply to situations where identification and authentication have already occurred and are not repeated but rather to situations where identification and authentication have not yet occurred. Organizations may decide that there are no user actions that can be performed on organizational systems without identification and authentication, and therefore, the value for the assignment operation can be “none.”

Withdrawn enhancements: AC-14(1).

Assessment objectives (SP 800-53A)

Objectives and methods for AC-14

Determine if:

• AC-14a. [Assignment: organization-defined user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions are identified;
• AC-14b.
  • AC-14b.[01] user actions not requiring identification or authentication are documented in the security plan for the system;
  • AC-14b.[02] a rationale for user actions not requiring identification or authentication is provided in the security plan for the system.

Examine: Access control policy; procedures addressing permitted actions without identification or authentication; system configuration settings and associated documentation; security plan; list of user actions that can be performed without identification or authentication; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities.

Policy statement

• The System owner shall identify Fill in: user actions that can be performed on the system without identification or authentication Typical: viewing public web pages and the logon page as the only user actions that can be performed on the system without identification or authentication. (AC-14a)
• The System owner shall document those actions, with the supporting rationale, in the system security plan. (AC-14b)

From the Access Control Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AC-14 asks you to list what anyone can do on the system before they identify themselves, and to justify each item in the security plan. Most systems allow a short list, such as reading public pages and reaching the logon page. If nothing is allowed before logon, record “none”, as NIST’s discussion permits.

AC-14 covers only actions taken before anyone has identified or authenticated. It is not about a session where a user has already logged on and is not asked again.

Common implementations. Web server, application and API routing that requires authentication by default and marks each public path explicitly. An identity-aware proxy or application gateway that enforces sign-in in front of internal applications. A table in the system security plan listing each action allowed without logon, the component that offers it, and why. Self-service password reset and account registration also start before logon, so if the system offers them, they belong on the list.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
User actions permitted without identification or authentication (a)	Viewing public web pages and the logon page

The Access Control policy assigns the list and its rationale to the system owner, recorded in the security plan (item b).

Evidence assessors ask for.

• The list of actions allowed without identification or authentication, with the rationale for each, in the system security plan
• Web server, gateway or application configuration showing which paths allow anonymous access, with authentication required by default
• A test: the assessor browses the site or calls the API without signing in and confirms that only the listed actions work
• Scan results for the system’s internet-facing addresses, compared with the list

Inheritance. A shared gateway or identity-aware proxy that requires sign-in by default is often a common control. The system still owns its own list, since only it knows which of its pages and functions are public, so AC-14 is usually a hybrid or system-specific control.

Common findings.

• API endpoints, file shares or storage links that return data without authentication and are not on the list.
• Documentation pages, debug endpoints or administrative consoles reachable without logon.
• A list that says “none” while the system serves a public page or a password reset page.
• Actions listed with no rationale, which item b requires.

Enhancements in the Moderate baseline. None. AC-14 has no enhancements in any baseline; AC-14(1) was withdrawn. The logon page itself shows the system use notification, AC-8, and content on public pages is managed under AC-22.

Artifacts

• Access Control Decision Worksheet
• Access Control Policy