View source for Doc:NIST SP 800-53r3 Appendix F/AC-14


{{ControlName
| Number=AC-14
| Name=PERMITTED ACTIONS WITHOUT IDENTIFICATION OR AUTHENTICATION
}}

{{ControlDesignation
| Text=The organization:
}}

{{ControlElement
| Number=a
| Text=Identifies specific user actions that can be performed on the information system without identification or authentication; and
}}

{{ControlElement
| Number=b
| Text=Documents and provides supporting rationale in the [[Term:Security Plan|security plan]] for the information system, user actions not requiring [[Term:Identification and Authentication|identification and authentication]].
}}

{{SupplementalGuidance
| Text=This control is intended for those specific instances where an organization determines that no [[Term:Identification and Authentication|identification and authentication]] is required; it is not, however, mandating that such instances exist in given information system. The organization may allow a limited number of user actions without [[Term:Identification and Authentication|identification and authentication]] (e.g., when individuals access public websites or other publicly accessible federal information systems such as http://www.usa.gov). Organizations also identify any actions that normally require identification or authentication but may under certain circumstances (e.g., emergencies), allow identification or authentication mechanisms to be bypassed. Such bypass may be, for example, via a software-readable physical switch that commands bypass of the login functionality and is [[Term:Protected|protected]] from accidental or unmonitored use. This control does not apply to situations where [[Term:Identification and Authentication|identification and authentication]] have already occurred and are not being repeated, but rather to situations where identification and/or authentication have not yet occurred. Related control: CP-2, IA-2.
}}

{{ControlEnhancements
| Text=
}}