SA-16 Developer-provided Training
Guidance: nonePolicy clause: draftWhat these mean
sa16ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| High | Organization | None |
Related controls: AT-2, AT-3, PE-3, SA-4, SA-5
Control statement
Section titled “Control statement”Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms: [Assignment: organization-defined training].
NIST discussion
Developer-provided training applies to external and internal (in-house) developers. Training personnel is essential to ensuring the effectiveness of the controls implemented within organizational systems. Types of training include web-based and computer-based training, classroom-style training, and hands-on training (including micro-training). Organizations can also request training materials from developers to conduct in-house training or offer self-training to organizational personnel. Organizations determine the type of training necessary and may require different types of training for different security and privacy functions, controls, and mechanisms.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for SA-16
Determine if the developer of the system, system component, or system service is required to provide [Assignment: organization-defined training] on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms.
Examine: System and services acquisition policy; system and services acquisition procedures; procedures addressing developer-provided training; solicitation documentation; acquisition documentation; service level agreements; acquisition contracts for the system, system component, or system service; organizational security and privacy training policy; developer-provided training materials; training records; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.
Interview: Organizational personnel with system and service acquisition responsibilities; organizational personnel with information security and privacy responsibilities; system developer; external or internal (in-house) developers with training responsibilities for the system, system component, or information system service.
Policy statement
- The System owner shall require the developer of the system, system component or system service to provide Fill in: training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms provided by the developer of the system, system component, or system service Typical: role-based training for the system’s administrators and security staff on configuring, operating and monitoring the security and privacy functions the developer provides, before the system goes into operation and after each major release, with materials the organization may reuse for in-house training on the correct use and operation of the implemented security and privacy functions, controls and mechanisms. (SA-16)
- The System owner shall ensure the personnel who operate those functions complete the training before they are given the related privileges. (SA-16)
From the System and Services Acquisition Policy template (draft). Highlighted fields are values your organization sets.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.