For SOC 2, run security awareness training for every new hire soon after they join and again at least once a year, keep completion records with dates, and cover the topics in your own policies. Short and relevant beats long and generic. Auditors sample people, so every person needs a record.
What the criteria are after
The control environment criteria expect you to attract, develop and retain competent people and to hold them accountable. Other criteria expect people to understand their responsibilities for security. Training is the usual proof.
The criteria do not set a length, a format or a vendor. You define it, then follow what you wrote.
A lean program
Onboarding session. Within a defined number of days of the start date, each person completes training and acknowledges the main policies. Pick the window and write it down.
Annual refresher. Same group, once per year, with updated content.
Role based add ons. Engineers get secure coding and secrets handling. Support staff get social engineering and data handling. Admins get access and change rules.
Phishing awareness. A simulated phishing exercise is common, not required. If you run one, keep the results and any follow up.
Content. Base it on your own policies: acceptable use, data handling, incident reporting, password and MFA rules, and how to report something odd. People should leave knowing who to tell and how.
Evidence to keep
- Training materials with a version or date.
- A completion list with name, date and result.
- Policy acknowledgements, with dates.
- A tracker showing who is overdue and the follow up taken.
- For new hires, proof that completion came inside your stated window.
Hold the list against the HR roster. The most common exception is a person who joined mid year and never got the onboarding session.
Common mistakes
- Training everyone at the annual date and forgetting joiners in between.
- Excusing leadership or founders. Auditors notice.
- Content that never mentions your actual tools or rules.
- No record for contractors with access.
- Setting a deadline in the policy that your process cannot meet.
Make it stick
Measure something useful: how fast people report suspicious email, or how many pass a short check after training. Use the numbers to adjust content. That also gives you a real answer when a buyer asks whether training works.
A sample calendar
Month one for a new hire: onboarding session and policy acknowledgements in the first week, role based module in the first month. Every January or another fixed month: annual refresher for everyone, with a two week window and a reminder at day ten. Quarterly: a short note on a recent real incident or phishing attempt, which keeps awareness alive between formal sessions. Each quarter, compare the HR roster to the completion list and chase gaps before the auditor finds them.
What to do when someone misses it
Write down the escalation. A first reminder, a second reminder copied to the manager, then a temporary access restriction if the policy allows it. Keep the reminders as evidence. A documented follow up often turns a would be exception into a minor note.
Quick check
Is a video enough?
It can be, if it is relevant, tracked and followed by an acknowledgement or short check. The format is your choice.
Do contractors need training?
If they have access to in scope systems or data, yes. Treat them like employees for this control.
Last reviewed: 19 October 2026.
