Navigate

SA-16

SA-16: Developer-provided Training

The organization requires the developer of the information system, system component, or information system service to provide [organization-defined training] on the correct use and operation of the implemented security functions, controls, and/or mechanisms.

Supplemental

This control applies to external and internal (in-house) developers. Training of personnel is an essential element to ensure the effectiveness of security controls implemented within organizational information systems. Training options include, for example, classroom-style training, web-based/computer-based training, and hands-on training. Organizations can also request sufficient training materials from developers to conduct in-house training or offer self-training to organizational personnel. Organizations determine the type of training necessary and may require different types of training for different security functions, controls, or mechanisms.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
None

CSF Categories
PR.AT-3

Related Controls

The controls below (if any) were marked by NIST as being related to SA-16.

Control	Description
AT-2	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): a: As part of initial training for new users; b: When required by information system changes; and c: [organization-defined frequency] thereafter.
AT-3	The organization provides role-based security training to personnel with assigned security roles and responsibilities: a: Before authorizing access to the information system or performing assigned duties; b: When required by information system changes; and c: [organization-defined frequency] thereafter.
SA-5	The organization: a: Obtains administrator documentation for the information system, system component, or information system service that describes: 1: Secure configuration, installation, and operation of the system, component, or service; 2: Effective use and maintenance of security functions/mechanisms; and 3: Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions; b: Obtains user documentation for the information system, system component, or information system service that describes: 1: User-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms; 2: Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and 3: User responsibilities in maintaining the security of the system, component, or service; c: Documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent and takes [organization-defined actions] in response; d: Protects documentation as required, in accordance with the risk management strategy; and e: Distributes documentation to [organization-defined personnel or roles].

Enhancements

The controls below (if any) add on to the requirements of SA-16.

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-16.

CCI	Definition
CCI-003291	Require the developer of the system, system component, or system service to provide organization-defined training on the correct use and operation of the implemented security functions, controls, and/or mechanisms.
CCI-003292	Defines the training the developer of the system, system component, or system service is required to provide on the correct use and operation of the implemented security functions, controls, and/or mechanisms.