Assessment Objective
Determine if:
- SA-16 the developer of the system, system component, or system service is required to provide [Assignment: training] on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- procedures addressing developer-provided training
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- organizational security and privacy training policy
- developer-provided training materials
- training records
- system security plan
- privacy plan
- privacy impact assessment
- privacy risk assessment documentation
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security and privacy responsibilities
- system developer
- external or internal (in-house) developers with training responsibilities for the system, system component, or information system service
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | SA-16 [H] Developer-provided Training |