SA-16, Developer-provided Training, asks the organization to require the developer of a system, component or service to provide training on the correct use and operation of the implemented security and privacy functions, controls and mechanisms. The organization decides what training is needed.
800-53 binds US federal systems, and others through contract. For a small or mid size company it is a reference you can apply to vendors and contractors.
What it means in practice
The guidance says the control applies to external and in-house developers. Training can be web based, classroom style or hands on, including short micro training. You can also ask for the materials and run the training yourself. Different security functions may need different training.
Evidence to collect
- The contract clause or statement of work that requires the training.
- Training materials or a syllabus from the developer.
- Attendance and completion records for the people who operate the system.
Common gaps
Buying a tool with strong security features that nobody on your team was shown how to configure. Another gap is training given once and never repeated for new hires.
How to implement it
Put training in the acquisition contract, name the audience, and schedule a refresh when the system changes. Keep completion records with your other evidence.
A small worked example
A company buys a logging platform with fine grained access roles. The vendor offers a half day admin course. Your contract asks for it, two engineers attend, and you store the attendance record and slides. Six months later a new hire gets the same material through a recorded session. That sequence is the whole control in practice.
Quick check
Who can deliver SA-16 training?
The developer, or your own staff using the developer's materials, per the guidance.
