In Episode 13 of my NIST SP 800-53 Rev 5 Access Control explanatory series, I break down AC-14: Permitted Actions Without Identification and Authentication. I walk you through what the control actually says, why it shows up in every baseline (Low, Moderate, and High), and what NIST is really asking for: if you’re going to allow any actions on a system without unique user ID or authentication, you must identify those actions, document them, and provide a solid rationale in the SSP. I also simplify the intent in plain language: don’t “accidentally” leave unauthenticated functionality on a system just because it’s convenient. If there’s a legitimate mission or business need—like public access to a public-facing website—fine, but it needs to be explicitly approved and written down. From an assessor’s perspective (SCA or continuous monitoring self-assessments), I explain exactly what I look at: the access control policy/procedures and the SSP section for AC-14, including the rationale. And I emphasize a common issue I’ve seen: the rationale may have been valid years ago, but if it’s no longer needed, you need to call it out, remove the bypass, and update the documentation.