What is SOC 2 Security Awareness Training
SOC 2 is the AICPA attestation report that B2B SaaS buyers ask for before they sign. Security awareness training is named explicitly in Common Criterion CC1.4, and Type II auditors test the control across a six to twelve month period of operating effectiveness.
By Dmytro Koziatynskyi Last reviewed
SOC 2 makes security awareness training a Common Criterion, not a nice-to-have
SOC 2 is an attestation report issued by an independent CPA firm under AICPA SSAE 18 standards, evaluating a service organization against the Trust Services Criteria. The 2017 Trust Services Criteria (TSP Section 100, with 2022 revised points of focus) cover five categories: Security, Availability, Confidentiality, Processing Integrity, and Privacy. Security is mandatory and is built on nine Common Criteria families (CC1 through CC9). The other four categories are elective and are added when customer contracts or regulatory commitments demand them.
Almost every B2B SaaS, managed service, hosting provider, and data-handling vendor in North America is asked for a SOC 2 report by enterprise procurement. The report is the proxy that buyers use to satisfy their own vendor-risk programs without auditing each vendor themselves. A clean SOC 2 Type II shortens enterprise sales cycles by weeks. A qualified opinion or a missing report kills deals. Audits run annually for Type II, with a period of operating effectiveness usually six or twelve months long, performed by firms like Schellman, A-LIGN, Coalfire, Sensiba, Prescient Assurance, Insight Assurance, and Johanson Group.
Security awareness training sits inside Common Criterion CC1.4, which requires the entity to demonstrate a commitment to attract, develop, and retain competent individuals in alignment with objectives. The control activity language is explicit: the entity provides training to enable personnel to develop and maintain the competencies needed to support the achievement of objectives. CC1.5 layers in personnel responsibility and accountability. CC2.2 covers internal communication of security information. CC2.3 covers external communication. Together these four controls form the awareness and communication backbone that auditors test.
The most common qualified opinion pattern auditors flag is missing evidence: the entity ran the training, but cannot produce per-employee completion records covering the full audit period for everyone in scope. Generic videos with no completion tracking, an annual all-hands session with no roster, contractors excluded from the program, or new hires who joined mid-period and never received the module all generate audit findings. Auditors expect three artifacts: a documented training program (curriculum, cadence, scope), per-employee completion records with timestamps for the full audit period, and evidence of role-based depth where the curriculum varies by job function.
How SOC 2 governs security awareness and training
Scope and period of operating effectiveness
Type I reports test design at a single point in time. Type II reports test operating effectiveness across a defined period, typically six months for a first audit and twelve months thereafter. Every employee, contractor, and intern who held in-scope access during any day of the period must have evidence of completed training that covered them on the day they had access. New hires who joined on day 364 of a 365-day period are still in scope. Contractors who held production access for two weeks are still in scope. Auditors sample from the population of all in-scope personnel during the period, not from a snapshot at the end.
CC1.4 control activity and internal communication
CC1.4 requires the entity to demonstrate a commitment to competence. The point of focus reads that the entity provides training to enable personnel to develop and maintain the competencies needed to support the achievement of objectives. The auditor will ask for the documented training program description, the curriculum, the assignment policy, the completion tracking mechanism, and the remediation procedure for non-completers. CC2.2 layers in internal communication: the program must be communicated to personnel, with reminders, escalations, and management visibility into completion status across the organization.
Role-based training depth
A single video for everyone is the failure pattern. Auditors expect curriculum depth that matches the risk profile of the role. Engineering needs secure coding, OAuth consent abuse, secrets management, and AI assistant prompt-injection content. Customer support needs verification procedures, social engineering pretexts, and least-privilege principles. Finance and AP need business email compromise, deepfake wire fraud, and out-of-band verification. Executives and their assistants need whaling and personal-device hardening. Contractors need a baseline scoped to their access. The auditor reviews the curriculum mapping and samples completions from each role bucket.
Per-employee evidence and LMS exports
The audit deliverable is a per-employee completion register: name or anonymized ID, role, hire date, training assigned, training completed, completion timestamp, and (where applicable) score or pass status. Auditors sample from the personnel listing, request the corresponding training evidence, and trace each sample back to source. Acceptable evidence is an LMS export (Cornerstone, Workday Learning, Docebo, SAP SuccessFactors, Moodle, or any standards-compliant system) or a SCORM completion record. Screenshots, signed PDFs, and email receipts are weak evidence and invite follow-up requests.
Refresh cadence
The Trust Services Criteria do not name a refresh frequency. Annual is the practical floor. Auditors reading the CC1.4 description against modern attacker tradecraft and the AICPA implementation guidance increasingly expect more than annual: quarterly micro-modules, monthly phishing exercises, or role-specific refreshers tied to product changes or new attacker techniques. A program that ran one all-hands video at the start of the period and never refreshed it across a twelve-month audit window will draw an exception from a thoughtful auditor, even if every employee technically completed the single module.
Type I versus Type II evidence demands
Type I evidence is point-in-time: the program exists, the policy is documented, the LMS is configured, and the assignment was made. Type II evidence is operational: the program ran throughout the period, every in-scope person completed it on time, exceptions were tracked and remediated, and management reviewed completion status on a defined cadence. The Type II report is what enterprise buyers actually want to read, because it tells them the control worked in practice across the audit window. Type I gets you to first conversation. Type II closes the deal.
Real SOC 2 audit findings tied to security awareness gaps
SolarWinds 2020: clean SOC reports preceded the breach
SolarWinds held current SOC 1 and SOC 2 attestations when the SUNBURST supply-chain compromise was disclosed in December 2020. The Cybersecurity and Infrastructure Security Agency, the Department of Justice, and Mandiant traced the incident to attacker access in the Orion build pipeline that persisted undetected for months. The case is a standing illustration of what SOC 2 attests and what it does not: the report describes a service organization control environment against the Trust Services Criteria during a defined period, not a guarantee that no breach can occur. It also illustrates why auditors and buyers have pushed for stronger evidence around security awareness, secure development, and access control over the years since.
Common audit pattern: missing completion evidence for new hires and contractors
The most frequent qualified opinion or noted exception in published auditor practice notes from Schellman, A-LIGN, and similar firms is missing per-employee completion evidence for personnel who joined mid-period or who held contractor status. The entity ran an annual training in January, the new hire joined in August, the contractor held production access from June to September, and neither received the module within a reasonable window of access being granted. The Type II report cites an exception under CC1.4 because the control did not operate effectively for that population during the period of operating effectiveness.
Common audit pattern: annual video with no role-based depth
A second recurring pattern is a single generic awareness video assigned to all staff with identical content, no role-based modules, and no refresh during the period. The auditor reviews the curriculum, notes that engineering, finance, support, and executive roles received identical content, and either issues a management-letter recommendation or, for more rigorous auditors, a formal exception. The criterion language about competencies needed to support the achievement of objectives is read by experienced auditors as requiring curriculum that matches the risk profile of the role, not a one-size-fits-all module.
How RansomLeak satisfies SOC 2 security awareness requirements
CC1.4: documented security awareness program with role-based content
RansomLeak ships with a published curriculum mapped to standard role buckets (engineering, support, finance, AP, executives, IT, contractors). The program description, assignment policy, and completion criteria are all documented and exportable for auditor review. Role-based depth satisfies the CC1.4 point of focus that ties training to the competencies needed to support objectives.
CC1.4: per-employee completion evidence with timestamps
Every completed exercise generates a per-employee record with user identifier, role, exercise slug, completion timestamp, and pass status. Records are exportable as CSV, JSON, or piped through the LMS via SCORM 1.2 and SCORM 2004 packages into Cornerstone, Workday Learning, Docebo, SAP SuccessFactors, Moodle, or any standards-compliant system. The export format matches what auditors sample against during fieldwork.
CC1.4: training assignment to all in-scope personnel
Assignment is enforced at onboarding through the integration with HRIS or directory provisioning, so every new hire receives the role-appropriate exercises within a defined window of access being granted. Contractors are assigned through the same mechanism with a scoped baseline. The auditor sample of new hires and contractors traces back to a clean record rather than a missing one.
CC1.5: personnel responsibility and accountability
Completion status feeds back to managers and to the security team, with escalation paths for non-completers and remediation tracking for failed scenarios. The dashboard view supports the personnel-responsibility framing in CC1.5 by giving managers visibility into the security competence of their direct reports across the audit period.
CC2.2: internal communication of security information
The platform sends scheduled assignment notifications, completion reminders, and program updates to personnel through email and Slack or Microsoft Teams integrations. Management gets monthly summary reports of program status. The communication artifact set (notification templates, reminder cadence, escalation rules) is documented and available as auditor evidence under CC2.2.
CC2.3: external communication where required
For service organizations that include vendors and contractors in the trust boundary, the program supports external communication of security expectations through the same assignment mechanism, with separate role buckets and report views. This satisfies the CC2.3 point of focus on communication with external parties about responsibilities relevant to the entity.
CC1.1 and CC1.5: management oversight and review evidence
A quarterly management review report summarizes program coverage, completion rates by role, exception tracking, and remediation actions. The report is a tabular summary suitable for distribution to the audit committee or security steering group. Auditors testing CC1.1 and CC1.5 use this artifact to evidence that management exercised oversight of the awareness program throughout the period of operating effectiveness.
Refresh cadence beyond annual
New scenarios ship monthly, with a curriculum refresh that tracks attacker tradecraft as it shifts. Programs scoped at quarterly micro-modules and monthly role-based exercises produce a continuous stream of completion evidence that satisfies auditors who read CC1.4 as requiring more than a single annual touch. The refresh also addresses the modern threat surface (deepfake video, AI-generated phishing, MFA fatigue, OAuth consent abuse) that an annual video from twelve months ago does not cover.
How RansomLeak builds an audit-ready SOC 2 program
RansomLeak runs immersive, scenario-based exercises rather than recorded videos and static quizzes. Every exercise drops the learner inside a simulated inbox, phone call, SMS thread, or video conference and forces a real decision under realistic pressure. The completion record that drops into the LMS is therefore evidence of skill demonstrated, not of seat time logged. Auditors reading the CC1.4 control language about competencies needed to support objectives find this pattern far easier to defend than a play-button video with a final-screen acknowledgement checkbox.
Programs are scoped by role rather than blasted to all-staff. Finance and AP get business email compromise, vendor-invoice fraud, and deepfake-wire scenarios. IT and help-desk staff get vishing, MFA-reset pretexts, and verification procedures. Engineering gets least-privilege, OAuth consent, and safe AI usage. Executives and their assistants get whaling, deepfake video, and reporting culture. Contractors get a scoped baseline. Every assignment lands in the same LMS that already houses the rest of the workforce training stack, through SCORM 1.2 and SCORM 2004 packages or direct API integration with Cornerstone, Workday Learning, Docebo, SAP SuccessFactors, and Moodle.
The audit evidence pack is the deliverable auditors actually want: program description, curriculum mapping by role, assignment policy, per-employee completion register for the full period of operating effectiveness, exception tracking with remediation timestamps, and a quarterly management review summary. The pack matches the artifact list in the AICPA SOC 2 description criteria and in the implementation guidance from major audit firms. Buyers reviewing the SOC 2 report find the awareness section described concretely rather than in marketing prose, which strengthens trust at the point of the procurement read.
What does SOC 2 require for security awareness training?
SOC 2 security awareness training is the role-based program that satisfies AICPA Trust Services Criterion CC1.4, which requires service organizations to provide training so personnel develop and maintain the competencies needed to support objectives. The control sits in the Common Criteria family of TSP Section 100. CC1.5 adds personnel responsibility, while CC2.2 and CC2.3 require internal and external communication of security information.
Auditors expect three artifacts: a documented program (curriculum, cadence, scope), per-employee completion records with timestamps for the entire audit period, and role-based content depth. The most common Type II exception is missing evidence for new hires and contractors who joined mid-period. Annual is the practical floor for refresh cadence; quarterly or monthly modules are the modern expectation.
Effective programs reduce breach impact. The Ponemon Cost of a Data Breach 2024 reports a 23% reduction in breach cost where security training is in place. Type I attests design at a point in time; Type II attests operating effectiveness across six to twelve months and is the report enterprise buyers actually want to see before signing.
Recommended exercises
Scenario-based simulations that satisfy this framework.
Employee Security Responsibilities
Drills the personnel-responsibility framing that satisfies CC1.5, with role-aware coverage of access duties, reporting expectations, and accountability.
Try the exercisePhishing
The baseline awareness exercise that auditors expect every in-scope employee to complete during the period under CC1.4.
Try the exerciseBusiness Email Compromise
Role-based depth for finance and AP that satisfies the CC1.4 point of focus on competencies needed to support objectives.
Try the exerciseMFA Setup & Best Practices
Hands-on training on phishing-resistant MFA that pairs CC1.4 awareness evidence with CC6.1 logical access control evidence.
Try the exerciseMFA Fatigue Attack
Drills the push-bombing pattern that bypasses traditional MFA, addressing the modern threat surface auditors expect curriculum to cover.
Try the exerciseLeast Privilege Awareness
Role-based depth for engineering and IT staff that maps to the access-control criteria in CC6.1 alongside the awareness criterion in CC1.4.
Try the exerciseReporting Culture
Builds the verification reflex and reporting habit that supports CC2.2 internal communication and CC7.3 incident response.
Try the exerciseGeneral Incident Reporting
Operationalizes the reporting flow that satisfies CC7.2 anomaly detection and CC7.3 incident response evidence requirements.
Try the exerciseFurther reading
Deeper guides on adjacent topics.
Related glossary terms
Quick definitions for the terms in this framework.
Frequently Asked Questions
What GRC and security leaders ask about this framework.
What is SOC 2 CC1.4?
CC1.4 is one of the nine Common Criteria families in the AICPA Trust Services Criteria (TSP Section 100, 2017 with 2022 revised points of focus). It requires the service organization to demonstrate a commitment to attract, develop, and retain competent individuals in alignment with objectives.
The control activity language is explicit: the entity provides training to enable personnel to develop and maintain the competencies needed to support the achievement of objectives. Auditors read this as requiring a documented security awareness program with per-employee completion evidence and role-based content depth.
Does SOC 2 require security awareness training?
Yes. Security awareness training is named explicitly in Common Criterion CC1.4 within the Trust Services Criteria. The criterion is mandatory for any SOC 2 report that includes the Security category, which is the only category required for every SOC 2 attestation.
The criterion is enforced through a documented program, per-employee completion records, role-based content, and a refresh cadence sufficient to keep the workforce competent against current threats. Type II auditors test that the control operated effectively across the entire period of operating effectiveness, not just at a single point in time.
How often does SOC 2 security awareness training need to be refreshed?
The Trust Services Criteria do not name a specific refresh frequency. Annual is the practical floor that most auditors accept for a baseline program, and it is what most service organizations document in their training policy.
Modern auditor practice notes from firms like Schellman, A-LIGN, and Coalfire increasingly read CC1.4 as requiring more than annual: quarterly micro-modules, monthly role-based exercises, or refreshers tied to new attacker techniques. A program that runs one all-hands video and nothing else across a twelve-month period of operating effectiveness will draw an exception from a thoughtful auditor.
What evidence do SOC 2 auditors check for training?
Auditors expect three artifacts. First, a documented training program description: curriculum, cadence, scope, assignment policy, and completion criteria. Second, a per-employee completion register for the full period of operating effectiveness, listing user identifier, role, training assigned, completion timestamp, and pass status. Third, evidence of role-based content depth that matches the risk profile of each job function.
Acceptable evidence is an LMS export (Cornerstone, Workday Learning, Docebo, SAP SuccessFactors, Moodle) or a SCORM completion record. Screenshots, signed PDFs, and email receipts are weak evidence and invite follow-up requests. Auditors sample from the personnel listing and trace each sample back to the source training record.
Type I versus Type II for training evidence: what is the difference?
Type I evidence is point-in-time: the program exists, the policy is documented, the LMS is configured, and assignments have been made. The auditor inspects design and confirms the control is in place on a single date.
Type II evidence is operational: the program ran throughout the period of operating effectiveness (six or twelve months), every in-scope person completed it on time, exceptions were tracked and remediated, and management reviewed completion status on a defined cadence. Enterprise buyers usually require Type II reports because Type II tells them the control worked in practice across the audit window, not just on the day the auditor visited.
Do contractors need SOC 2 security awareness training?
Yes, when contractors hold access to in-scope systems or data during the audit period. The SOC 2 personnel population includes employees, contractors, interns, and any third party with logical or physical access relevant to the trust boundary.
The most frequent qualified opinion pattern in Type II reports is missing completion evidence for contractors who held access for a short window during the period and never received the training assignment. The control needs to operate effectively for that population during the days they held access, not after they left.
How is SOC 2 training different from ISO 27001 awareness training?
The intent is similar; the framing differs. ISO/IEC 27001 Annex A (specifically A.7.2.2 in the 2013 version, A.6.3 in the 2022 version) requires information security awareness, education, and training. SOC 2 places the same requirement inside Common Criterion CC1.4 of the Trust Services Criteria, with CC1.5, CC2.2, and CC2.3 layering in personnel responsibility and communication.
The audit mechanic is also different. ISO 27001 is a certification against a management system standard with a three-year cycle and annual surveillance. SOC 2 is an attestation by a CPA firm that issues a report against the Trust Services Criteria for a defined period. Most enterprise buyers in North America ask for SOC 2; most enterprise buyers in Europe and APAC ask for ISO 27001. Many service organizations hold both.
What happens if a SOC 2 audit finds a training gap?
The auditor records an exception in the Type II report against the relevant Common Criterion (usually CC1.4). The exception describes the population sampled, the gap found, and the affected period. Depending on severity and scope, the report opinion is either unqualified with noted exceptions or qualified.
A qualified opinion is the failure mode that procurement teams flag. Buyers reviewing a qualified report ask follow-up questions, request remediation evidence, and may delay or block the contract. The remediation path is to close the gap, document the corrective action, and earn an unqualified opinion in the next reporting period.
Sources & further reading
Primary sources cited above and adjacent guidance.
- SOC 2 Report — AICPA
- 2017 Trust Services Criteria with Revised Points of Focus 2022 — AICPA
- Cost of a Data Breach Report 2024 — IBM Security and Ponemon Institute
- SSAE No. 18 Attestation Standards — AICPA
Make This Framework Audit-Ready
Book a 30-minute walkthrough. We will scope the exercise sequence, the assignment logic, and the evidence export your auditor expects.