Security awareness training for SOC 2
A SOC 2 report is based on the AICPA Trust Services Criteria. Staff awareness training is usually mapped to CC1.4 (competence) and CC2.2 (communicating responsibilities, including how to report problems). Our courses and LMS records give you the all-staff part; technical training for specific roles stays with you.
Key facts
| Framework | AICPA Trust Services Criteria (2017, points of focus revised 2022) |
|---|---|
| Who it applies to | US service companies whose customers ask for a SOC 2 report |
| Criteria for training | CC1.4 (competence) and CC2.2 (communicating responsibilities) |
| How we describe our part | Maps to the SOC 2 criteria CC1.4 and CC2.2 (all-staff awareness) |
| Our library | A new US library of 51 finished courses |
The criteria text sits behind an AICPA account, so this page names the criteria by number with a plain description, no titles or quotes. Check the exact wording with your auditor.
Criteria and the course topics that cover them
The UK and US edition is a new library made for UK and US teams: 40 story courses and 12 standards courses, 52 in all, all finished. Course names here are the names in that library; they have no course pages of their own yet.
| What it asks | Our course topics |
|---|---|
|
CC1.4 Competence |
The programme: every course assigned to all staff, with LMS records. Standards course: Security for Managers Technical skills for specific roles, and hiring and retention practice, are yours. |
|
CC2.2 Communicating responsibilities (security knowledge and awareness) |
The programme: every course assigned to all staff, with LMS records. Standards course: Acceptable Use of Work Technology |
|
CC2.2 Communicating how to report failures, incidents and concerns |
Also: Spotting Fake Emails; Stopping a Ransomware Attack; Website Outage Response; Secure Disposal of Documents; Resisting Bribes for Access; Safe Software Downloads Standards course: How to Report (and why no one is blamed); Security Onboarding: Your First Week |
When training must happen
The criteria do not set a training interval in words we have checked. In practice, auditors usually test training at hire and every year, so plan for both and record both.
What an auditor asks to see
Evidence for SOC 2
- For each person: the courses assigned, the date they finished, the quiz score and the certificate.
- Your list of who must be trained, and proof that new joiners were trained.
- Your security policies and how staff were told about them.
What our LMS gives you today
- Assignments: give courses to teams or people and see who finished.
- A scenario quiz after every course: 10 questions from a bank of 13 to 15, pass mark 80, a score for each learner.
- A certificate for every learner who passes.
- One space per client, and your own report method and security contact on the last screen of each course.
- The full transcript of every course on its course page, as a copy of the training material.
What stays your job
Our library is the all-staff awareness layer. These parts of SOC 2 are yours:
- Technical training for specific roles (engineers, administrators, the security team).
- Hiring, development and retention practice (CC1.4).
- Your security policies, and a record that staff accepted them.
- Practical exercises such as phishing simulations, if your auditor expects them.
Questions people ask
Does SOC 2 require security awareness training?
SOC 2 has no single training clause. Auditors usually look for all-staff awareness training under CC1.4 and CC2.2, with records of who was trained and when.
How often should staff be trained for SOC 2?
The criteria set no interval we can quote. Auditors usually test training at hire and every year.
Which topics do SOC 2 auditors expect?
Usually security policies, how to report problems, phishing and data handling. Our library covers these; your own policies stay yours.
Sources
Last updated: 2026-10-16. This page explains how our training relates to SOC 2; it is not legal advice.