Developer-Provided Training SA-16

Source: NIST SP 800-53 Rev.5, System and Services Acquisition family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

SA-16 (Developer-Provided Training) says whoever builds or supplies the system also has to train the people who will run it on how to correctly use its security and privacy features. It is a High-baseline control, reserved for the most sensitive systems, because there a misused control is as dangerous as a missing one. For a lab server you both build and run, this becomes writing the operator guidance you would hand to the next administrator.

What good looks like

• The people who operate the system are trained on how its security features actually work — not left to guess.
• Training is specific to this system's controls — how to use its firewall, its authentication, its logging — not generic awareness.
• The material covers correct use and operation — the right settings, the common mistakes, and how to tell when something is wrong.
• Training stays current as the system's controls change.
• For a self-run lab, the ‘training’ is written operator guidance the next administrator could follow unaided.

Framework mapping

How to move it toward Implemented

• Write a runbook for this server's security features — how authentication, sudo, the firewall (ufw or nftables), and logging are configured and correctly used.
• Include a common-mistakes section and, for each control, how to verify it is working — the command to run and the expected output.
• Keep the runbook versioned alongside the config so it updates when the controls do.
• Attach the operator runbook as hardening evidence on the asset, naming SA-16 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.