The SOC 2 training question every CISO dreads
You’re two weeks from your SOC 2 audit and the auditor asks: “Can you show me evidence of your security awareness training program?” What they’re really asking is whether you can prove, with documentation, that your entire workforce has received relevant security training — and that the training is ongoing, not just a one-time checkbox.
What SOC 2 actually requires
SOC 2 is built around the Trust Services Criteria. The relevant criterion for security training is CC1.4, which requires that the organization “demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.” In practice, auditors interpret this to mean:
- All employees must receive security awareness training
- Training must be documented with completion records
- Training must be relevant to employees’ roles and responsibilities
- There must be evidence the training program is reviewed and updated regularly
- New employees must complete training as part of onboarding
The evidence auditors want
When your auditor asks about security training, they’re looking for a specific evidence package. Here’s what to have ready:
Completion records
A report showing every employee, their completion date, and the specific training modules they completed. Ideally this is exportable from your training platform as a CSV or PDF. Auditors want to see 100% (or near-100%) completion rates — exceptions need documented explanations (e.g., employee was on leave).
Training content
A description or sample of what the training covers. Auditors will check that the content is relevant to real threats — phishing, password security, data handling, incident reporting. Generic click-through videos with no assessment components are increasingly flagged.
Policy acknowledgment
Signed or digitally acknowledged security policies are separate from but complementary to training records. Most auditors want to see both.
Training program documentation
A brief policy document describing your training program: how often it runs, who is required to complete it, how completion is tracked, and how content is updated. This doesn’t need to be elaborate — a one-page document is sufficient.
Common audit findings related to training
The most frequent SOC 2 deficiencies related to security training are:
- Incomplete completion records (some employees not in the system)
- Training that was completed once but not repeated annually
- No evidence of training content being updated to reflect new threats
- Contractors and third-party staff not included in the training program
How to be audit-ready year-round
The best approach is to treat SOC 2 training compliance as an ongoing operational process, not an audit-time scramble. Automated platforms that track completion, send reminders, and generate reports on demand make the difference between a clean finding and a remediation item. When your auditor asks for training records, you should be able to produce them in under five minutes.