What SOC 2 Requires for Security Training

CC2.2 of the SOC 2 Trust Services Criteria requires that management communicates security policies and responsibilities to personnel. In practice, this means:

• Employees receive security awareness training at least annually
• New hires complete training as part of onboarding
• Training completion is documented and retained
• The training covers security policies and their responsibilities under those policies

This is one of the simpler SOC 2 controls to satisfy — but also one where teams generate weak evidence. "We had a training session" without records of who attended, what was covered, and when it happened is not evidence. The record is what auditors check.

Minimum Viable Training Program

For a team under 50 people, a lean but auditable training program:

Annual training (all employees):

• 30–60 minute asynchronous module covering security policies and responsibilities
• Covers: password hygiene, phishing recognition, acceptable use, incident reporting
• Completion tracked per employee (name + date + completion confirmation)
• Brief acknowledgment that they've read the security policies

New hire training (within first 2 weeks):

• Same or condensed module delivered during onboarding
• Completion documented before granting access to production systems
• Signature or digital acknowledgment of security policies

What to use:

• Dedicated platforms: KnowBe4, Proofpoint Security Awareness Training, SANS Security Awareness
• Lightweight alternatives: A Notion/Google Doc with a completion quiz and acknowledgment form; a recorded Loom video with a follow-up quiz
• Any format works — what matters is the completion record

Training Topics That Map to SOC 2

Your training should reference the specific policies that exist in your security program:

|---|---| At the end of training, employees should acknowledge: (1) they received the training, (2) they understand their security responsibilities, (3) they've read the Information Security Policy.

Completion Records: What Auditors Examine

Auditors sample training completion records — they pick 3–5 employees hired or tenured during the observation period and verify that training completion exists for each one.

Minimum record:

• Employee name and email
• Training module name and version
• Completion date
• Acknowledgment signature or digital confirmation

Store records for: the duration of the audit observation period plus one additional year.

If you use a training platform, export the completion report quarterly and retain it. If you use a Google Form or Typeform, export responses regularly. If someone misses training, document the follow-up and the eventual completion.

Phishing Simulations — Above the Minimum

Phishing simulations are not required for SOC 2, but they're a positive signal that your training program is doing more than checkbox compliance — and they provide quantitative evidence of program effectiveness over time.

Quarterly simulations with click-rate tracking give you:

• A trend line showing security awareness improving year-over-year
• Automatic enrollment of clickers into remedial training
• Evidence for CC7.2 that you're actively testing your threat detection and human firewall

Platforms: KnowBe4, Proofpoint, GoPhish (self-hosted open source).

Document simulation results: dates, click rates, follow-up training enrollment. This becomes a powerful SOC 2 evidence package.

SecureSpect Training Module

SecureSpect's Training module tracks security awareness training completion for your team. Link to your external training platform, upload completion records, or use built-in tracking. Completion status is visible per employee, and the module flags overdue training — anyone hired in the last 14 days without completed onboarding training, or anyone overdue for their annual training. Auditor-ready completion reports export in one click.