Security awareness training for SOC 2

Why this matters

A SOC 2 auditor does not look for a checkbox called training. They look for evidence that your people know the rules and that you can prove it. Awareness training often maps to CC1.4, which covers competence, and CC2.2, which covers internal communication. A slide deck with a sign in sheet is weak evidence. Dated assignments, versioned content, quiz results and follow up are stronger.

Training has to change behavior. Staff should know how to report a suspicious email, lock a laptop, handle customer data and escalate an incident. If the content is generic, people click through it and learn little. An auditor may interview employees. If those answers do not match your policy, the training did not work.

Scope matters. Include full time staff, part time staff, contractors and offshore teams. New hires need training soon after start, and everyone needs a refresh at least once a year. If your roster covers only payroll, you have a gap.

Before you start

Name one owner. Security can own the content and HR can own the roster. Do not split accountability across three people with no final decision maker. Write the requirement in your security policy: who must train, how soon after hire, how often, what counts as complete and who approves exceptions.

Build the audience from systems, not memory. Pull active workers from the HRIS or payroll system and contractors from the vendor or contractor tracker. Tag each person with a role group: general staff, engineers, finance, support and managers. Those tags drive different modules later.

Decide the evidence format before you deliver anything. You need the course title, version, date, audience, completion date, quiz score and acknowledgment. You also need reminder logs and exception approvals. If your training tool cannot export that, pick another tool or keep a manual tracker. Test the export with one user.

Set the calendar and pass mark. Avoid the last month of the fiscal quarter if that is your busy season. Give people a make up window. A short course with a quiz and a clear deadline works better than a long course with no end date.

How to do it

Treat training as a control, not an event. A one page standard makes the control testable. It should say who is in scope, the deadline, the annual cycle, the pass mark, the evidence you keep and the exception path. Get the policy owner to approve it before the first assignment.

Keep the core module short and practical. Cover acceptable use, data handling, phishing, passwords and MFA, incident reporting, remote work and clean desk. Add short role modules. Engineers need secure coding, secrets and code review. Finance needs payment fraud and vendor change checks. Support needs identity verification. Managers need to know how to handle a report.

Run the cycle in the same order every year. Assign, remind, chase, close, file. Use manager reports so team leads see who is late. Hold one live make up session for people who ignore email. After you close the cycle, read the quiz misses and update the weak parts.

1. Write the training standard. Define the audience, deadline, annual cadence, pass mark, evidence and exception path. Get the policy owner to approve it.
2. Build a role based curriculum. Start with a core module for everyone, then add short modules for engineers, finance, support and managers. Map each topic to a policy.
3. Choose the delivery and record system. Use an LMS or compliance tool with assignment rules and exportable completion reports, or a simple form and spreadsheet if you are small. Test the export before you assign.
4. Load the audience from HR and contractor records. Use start dates and role fields. Reconcile with the payroll or HRIS list so no one is missed.
5. Assign and announce. Send the assignment with the deadline, why it matters and how long it takes. Tell managers which of their people are outstanding.
6. Run reminders and a make up session. Send reminders on a fixed schedule, then hold a live session for stragglers. Record attendance and quiz results.
7. Close the cycle and file evidence. Export completion, quiz scores, acknowledgments and exception approvals. Store them in the audit folder with the content version and date.
8. Review and update. Read quiz misses and phishing reports. Update weak content and set the next cycle.

How to check it worked

Compare completion to the roster, not to the number of assignments sent. Look for gaps by team, manager, contractor group and start date. A new hire who has been on the job for two months with no training is a finding. A contractor missing from the list is a scope gap, not a training gap.

Read quiz results by question. If many people miss the incident reporting question, the question may be unclear or the content may be buried. Do not celebrate a high pass rate if the quiz only asks people to click the right button. Check the acknowledgment log against the policy version.

Run phishing simulations as a practice drill. Track how many people report the message and how quickly. Do not punish clicks. Punish hiding. After the simulation, show the header clues and the report button. Record the simulation date, the audience and the debrief. Pair every simulation with a short lesson.

Interview a sample of staff. Ask where they report a lost laptop, whether they can send customer data to a personal email and how they get approval for a new app. If their answers differ from the policy, fix the policy or the training. Write down what you changed and when.

Mistakes to avoid

The annual checkbox is a common failure. A generic slide deck, a sign in sheet and no follow up gives an auditor little to test. Another failure is training that contradicts the policy. If the course says to report incidents to the help desk and the policy names the security team, fix both.

Leaving contractors, new hires or offshore staff out of the roster creates a visible gap. So does skipping version control. If you cannot show which content ran in which period, the evidence is hard to defend. Not chasing non completers is another gap. So is approving exceptions verbally with no record.

Long modules with no role relevance teach people to click Next. Shorter scenarios that match the work are easier to finish and easier to remember. Do not rely on completion alone. A person can finish a course and still not know how to report a phishing email.

You can run this in house, use an LMS template or bring in help. One option among others is the SOC 2 readiness assessment from Cloudverg, a fixed price $7,500 engagement that runs three weeks and includes a gap assessment, a policy and evidence inventory, and a remediation roadmap. Whichever route you choose, keep the training record tied to the control and to the policy version.

Frequently asked questions