SOC 2 guide
SOC 2 training: who needs what, and what counts as evidence of awareness
Where the Trust Services Criteria place training, what oversight bodies, control owners, engineers, all personnel and contractors each need, the dated records a CPA firm samples in a Type 2 examination, and a training matrix to adapt.
Key points
- The Trust Services Criteria prescribe no courses, hours or intervals. Training earns its place through the control environment series (CC1), on competence and accountability, and the communication series (CC2), on objectives and responsibilities.
- Everyone in scope needs security awareness at onboarding and on a recurring cycle, most often annual; oversight bodies, control owners, engineers, administrators and contractors with access need more.
- In a Type 2 examination the CPA firm samples people from across the period and inspects dated completions, policy acknowledgements, onboarding checklists and any phishing results your controls promise.
- Your own control wording sets the bar: commit to a deadline your onboarding cannot meet and every late joiner sampled becomes a reported exception.
Where training sits in the Trust Services Criteria
SOC 2 comes without a training syllabus. The criteria describe outcomes, you design the controls that achieve them, and the CPA firm tests those controls as your system description states them. Two series within the common criteria, which every report includes, carry the weight for training.
CC1: the control environment
This series covers integrity and ethical values, oversight, structures and reporting lines, commitment to competent people, and accountability for internal control responsibilities. Training lives in the last two: people must be capable of their security duties and answerable for them, which is why a signed code of conduct and a disciplinary process usually sit beside the training records.
CC2: communication and information
This series asks for quality information that supports the controls, shared internally and with clients and vendors. Internally, people should know what the security programme is for, which responsibilities are theirs, where policies are published and how to report an incident or concern; awareness training and policy acknowledgement usually demonstrate it.
Awareness as a control the CPA firm samples
Security awareness training is its own control in nearly every SOC 2 control set, with everyone in scope as its population. Other series depend on trained people without naming training: access (CC6), operations (CC7) and change (CC8) controls run consistently only when their engineers know the procedure. SOC 2 Trust Services Criteria explained, criterion by criterion
Who needs what, from the oversight body to the contractor
Board or executive oversight
A board, an audit committee or, in a smaller company, the leadership team needs enough to question rather than approve: client commitments, risk assessment results, the last report's exceptions and remediation progress. A briefing before the first examination period, and security as a standing agenda item, leave the minutes the CPA firm will ask for.
Control owners
HR typically owns onboarding, background checks and leavers; IT owns access reviews; engineering leads approve changes. Each owner needs the exact wording of the control, its frequency, the record it must leave and the escalation route when it cannot run on time. A review that slips silently becomes an unexplained exception; one escalated, completed late and explained shows a managed control.
Engineers and administrators
People with production access need secure development and peer review, the change process including emergency changes, least privilege and privileged access, secrets handling, logging and the incident runbook. Awareness modules never reach this material; the CPA firm judges it through the tickets and approvals the teams produce.
All personnel
Everyone in scope completes awareness training within the onboarding window your policy sets, then on each refresher cycle. Make the content yours: acceptable use, data handling, phishing and social engineering, multi-factor authentication, remote working and incident reporting. Put acknowledgement of the policies and the code of conduct in the same onboarding step, so one checklist evidences both.
Contractors
Contractors with access to in-scope systems or data belong in the population unless your control wording excludes them, and an exclusion invites questions about how that risk is covered. Train them as you train employees, or write equivalent duties into the contract and collect evidence from their employer. Granting in-scope access only after training closes the commonest gap: production access on day one, training weeks later.
A SOC 2 training matrix to adapt
Match the roles to your organisation chart and the content to your controls; the timing column is what the CPA firm will hold you to.
| Role | What they need | When |
|---|---|---|
| Board or executive oversight | Client commitments, risk assessment results, prior report exceptions, remediation status | Before the first examination period, then at least annually |
| Security or compliance lead | The criteria in depth, the system description, the control matrix and evidence calendar, CPA firm liaison | On appointment, and whenever the scope or categories change |
| Control owners | Wording, frequency, required evidence and exception handling for each control they own | Before the period begins, and when a control is added or reworded |
| Engineers and administrators | Secure development, change management, privileged access, secrets, logging, incident response | On joining the role, annually, and when tooling or procedures change |
| All personnel | Security awareness, acceptable use, data handling, phishing, incident reporting, policy acknowledgement | Within the onboarding window, then annually |
| Contractors with access | The same awareness and acknowledgements, or contractual training duties backed by evidence | Before in-scope access is granted, then on the staff cycle |
What the CPA firm samples as evidence of awareness
A Type 1 looks at design at one date: the policy, the content and the training platform exist and the control is in place. A Type 2 tests operation across the period: the CPA firm takes the in-scope population, usually from HR, samples new joiners and existing staff, and checks each against the timing your control promises.
| Evidence | What the CPA firm checks | What turns it into an exception |
|---|---|---|
| Training completion records | A dated completion for each person sampled, inside the onboarding window or refresher cycle, across the whole period | Completion after the deadline; a platform list that does not reconcile with the HR roster |
| Policy acknowledgements | Each person acknowledged the version of the policy in force at the time, with a date | Acknowledgements collected once and never repeated after a policy changed |
| Onboarding checklists | Awareness, acknowledgement, background check and access steps completed in the order the procedure sets | Access granted before training or screening was finished |
| Phishing simulation results | Campaigns run as often as the control states, with follow-up for people who clicked | A campaign skipped mid-period; results filed with no action taken |
| Role training records | Engineers, administrators and control owners trained as the matrix requires | Role training assumed from experience, with nothing recorded |
Records generated by the system that did the work, carrying dates and user identities, stand up better than screenshots or spreadsheets compiled before fieldwork. Sampled exceptions are printed in the report your clients read. SOC 2 policies and evidence: what you need and what you do not
Sterling Academy: awareness e-learning for the whole workforce
Sterling Academy's SOC 2 Awareness course is for people who operate or support controls in a SOC 2 scope: the purpose of the report, the five Trust Services categories, the part scope plays, and how controls, evidence and individual responsibilities support assurance. Information Security Essentials helps people spot cyber threats and work more safely; ISO/IEC 27001:2022 Awareness suits organisations that hold both.
Each course has practical checks between lessons and ends with a final exam. The certificate that follows is numbered and verifiable online through its QR code, so the record the CPA firm samples is dated, tested and traceable to one learner.
Your Sterling consultant trains the people who run your controls as part of the consulting work.
Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy access
How Sterling builds SOC 2 training evidence
Trained control owners, dated records and a population that reconciles before the period starts.
In a Sterling SOC 2 engagement, the gap analysis tests your onboarding, acknowledgement and training records against the control environment and communication criteria, and against the timing your controls will promise. We help word controls your teams can meet, train the people who operate them and keep the matrix and records in Effivity, included with the engagement, at no additional cost. Before the period begins, our readiness assessment samples your people as the CPA firm will, so late completions and missing contractors are corrected rather than reported. Sterling does not issue SOC 2 reports: the independent, licensed CPA firm you engage examines the controls and gives its opinion.
Book a free discovery callSOC 2 training: questions buyers ask
Does SOC 2 require annual security awareness training?
The criteria set no interval; your policy does, and the CPA firm tests against it. Most client questionnaires look for onboarding training plus an annual refresher, so commit only to a cycle you can evidence for everyone in scope.
Are phishing simulations required for a SOC 2 report?
No criterion requires them, though they show well whether awareness changes behaviour. A control that describes them is tested as written, so state only the frequency you will keep, retain the results and follow up with people who click.
Some new joiners finish training late. How does that appear in the report?
If a late completion is sampled, the CPA firm records an exception against the awareness control in its test results. Fix the cause, for instance by linking in-scope access to completion, and confirm before the next period that your onboarding window is realistic.
Do contractors and outsourced teams need our training?
If they reach in-scope systems or data and your control covers all personnel, yes, and they can be sampled like employees. For a vendor's own staff, contract terms backed by the vendor's evidence can work, overseen through your vendor management controls in the risk mitigation series (CC9).
Will the CPA firm accept a Sterling Academy certificate?
The CPA firm decides what it accepts. A certificate naming the learner, course, final exam and date is the completion record an awareness control calls for; it cannot show that an engineer follows the change process, which only the tickets can.
More SOC 2 guides
Every guide in the SOC 2 series is written for one question and links back to the hub for the whole picture.
- SOC 2 bridge letters, report validity and the annual cycle
- SOC 2 cost: what moves the price
- Effivity for SOC 2: the guide
- SOC 2 policies and evidence: what you need and what you do not
- The SOC 2 system description: what to write and what to leave out
- SOC 2 in the Philippines
- SOC 2 in the UK
- SOC 2 timeline
- SOC 2 training: who needs what, and the evidence of awareness
- SOC 2 Trust Services Criteria explained, criterion by criterion
- SOC 2 Type 1 vs Type 2: which report, and when
- SOC 2 in the UAE and GCC
- SOC 2 vs ISO/IEC 27001: which one, or both?
Keep exploring
Explore more about SOC 2
Watch a video on how to implement SOC 2 here.
Watch a video on SOC 2 requirements here.
SOC 2 resources
Services for SOC 2
Industries
Talk to a consultant
Build SOC 2 training evidence that stands up to sampling.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice