SC-14 Public Access Protections no longer has text of its own. In Revision 5 NIST marked it withdrawn and folded it into other controls. The OSCAL catalog lists the destinations as AC-2, AC-3, AC-5, AC-6, SI-3, SI-4, SI-5, SI-7 and SI-10.
NIST SP 800-53 binds US federal systems, and reaches contractors and cloud providers through contract terms such as FedRAMP. For everyone else it is a reference catalog. If a customer questionnaire or an older baseline still lists SC-14, you answer it by pointing to those controls.
What it means in practice
The old idea was simple. Systems that serve the public, such as a marketing site or a public API, need their own protections because anyone can reach them. Those protections are now spread across account management, access enforcement, separation of duties, least privilege, malware protection, monitoring, alerts, integrity checks and input validation.
A practical way to read this: if a public system has a login, SC-14's old concerns land in AC-2 and AC-3. If it accepts user input, they land in SI-10. If it needs to be watched, they land in SI-4 and SI-5. You do not need a new document. You need your existing documents to name the public systems explicitly, so that a reviewer sees them covered instead of assuming they are.
The free scan at https://gold.safeguard.sh/scan can check the dependencies of a public web application in your browser, which is one cheap input for SI-3 and SI-7 style evidence.
Evidence to collect
- The list of internet facing systems and who owns each one.
- Access enforcement settings for anything public that also has an admin side.
- Input validation tests or scanner output for public endpoints.
- Monitoring and alerting rules that cover those systems.
Common gaps
Teams answer "not applicable, withdrawn" and stop. An auditor will usually accept that only if you show you cover the replacement controls. Another gap is an out of date public inventory, so a forgotten test site stays exposed.
How to implement it
Keep one inventory of public surfaces. For each, record the owner, the replacement controls that apply, and the last review date. Then answer any SC-14 request with a short table that maps each surface to those controls.
Quick check
Can you mark SC-14 as not applicable?
You can say it is withdrawn, but show the controls it moved into. Check which baseline or contract your customer uses, because mappings vary.
