Permitted Actions Without Identification or Authentication AC-14

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-14 (Permitted Actions Without Identification or Authentication) is about deciding, on purpose, the short list of things a person can do on the system before they prove who they are. Identification means claiming an identity (a username); authentication means proving it (a password or key). The control asks two plain questions: which actions, if any, are allowed with no login — and where is that written down, with a reason? On a hardened system the honest answer is often ‘none,’ and AC-14 is the place you say so. It sits in the Low baseline.

What good looks like

• Keep the no-login list as short as possible — ideally empty. Anything allowed without a login is an action no one can be held accountable for.
• Where you do allow it, tie it to a real mission or business reason — for example, serving a public web page, or showing a login banner — not convenience.
• Document each permitted action, and its rationale, in the system security plan, so there is one source of truth.
• Confirm the list covers only the pre-login moment — not access that keeps going after a person is already identified.
• Re-check the list whenever you add a service — a new anonymous service quietly lengthens it.

Framework mapping

• NIST CSF 2.0 — PR.AA-01 — Identities and credentials for authorized users, services, and hardware are managed

How to move it toward Implemented

• Inventory what the server exposes with no login: list the listening services with ss -tulpn (ss stands for socket statistics), then check each one for anonymous access — for example, an open web port, or FTP (File Transfer Protocol) allowing the anonymous user.
• Trim the list: turn off or require a login for anything not needed — for example, disable anonymous FTP by setting anonymous_enable=NO in /etc/vsftpd.conf. If you keep a login banner as the one intended pre-login action, set its text in /etc/issue.net and point Banner /etc/issue.net in the SSH (Secure Shell) daemon config /etc/ssh/sshd_config.
• Write the decision down: in the system security plan, list each permitted-without-login action and its rationale — or state plainly that none are permitted — and save it as a dated file.
• Attach that page (or the ‘none permitted’ statement) as hardening evidence on the asset, naming AC-14 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.