Workforce Security
Personnel and contractors complete security and privacy awareness training during onboarding and at least annually thereafter.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Employees and covered contractors learn the security and privacy behaviors expected of them during onboarding and at least annually, with overdue training actively followed through to completion.
First SOC 2 program
Use a short, credible course that covers phishing and credential safety, incident reporting, acceptable use, customer-data handling, and privacy responsibilities. Enroll each new starter promptly, repeat the course annually, and track completion in one place.
As the company scales
Integrate the learning platform with the HR population, assign role-specific modules for privileged, engineering, support, and privacy roles, and use escalation rules and reconciliations to prevent people from falling between systems.
Identify employees and contractors who need training, including people without a standard corporate email account, and define onboarding and annual due dates.
You should end up with: A scoped learner list with assignment rules and due dates.
Review the course against the company’s real reporting channels, data-handling practices, major threats, and privacy commitments.
You should end up with: A dated course version and content approval record.
Enroll each new employee or covered contractor and communicate the deadline and consequences for non-completion.
You should end up with: Assignment records tied to each new starter and course version.
Reassign the current course to the full in-scope population and send escalating reminders to learners and managers.
You should end up with: Annual campaign records, reminder history, and completion report.
Investigate overdue learners, correct population or leave-status errors, and document manager escalation until each assignment is completed or formally exempted.
You should end up with: An overdue tracker with resolution notes and approvals.
Compare active personnel and in-scope contractors with training assignments and completions, then resolve missing or duplicate records.
You should end up with: A dated population reconciliation and final completion summary.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Shows which in-scope people completed the assigned onboarding or annual course, which version they took, and whether they met the applicable due date.
Include this context
learner identifier
Include this context
employment or contractor status
Include this context
course and version
Include this context
assignment date and due date
Include this context
completion date and result
Weak evidence to avoid
A dashboard showing 100% complete without learner names, course version, due dates, exclusions, or export date.
Confirm what the record proves
Shows that awareness training was assigned and tracked as part of a named starter’s onboarding rather than waiting for the next annual campaign.
Include this context
starter identifier
Include this context
start date
Include this context
training assignment
Include this context
due date
Include this context
completion status
Include this context
checklist owner
Weak evidence to avoid
A blank onboarding checklist or a checked training box with no learner, assignment, or completion record.
Confirm what the record proves
Shows that late assignments were identified, escalated to accountable managers, and resolved or formally exempted rather than removed from the report.
Include this context
learner and assignment
Include this context
original due date
Include this context
reminder or escalation dates
Include this context
manager or owner
Include this context
resolution and date
Weak evidence to avoid
An automated reminder email with no recipient-level follow-up, manager escalation, or final outcome.
Type 1
The active learner population, current onboarding and annual course assignments, latest course version, and all overdue or exempted assignments outstanding on the examination date.
Type 2
Every employee and covered-contractor start during the review period, every annual awareness assignment issued to the active in-scope population, and every overdue escalation or exemption resolved during the period.
Reconcile active personnel and all period starts from HR and contractor rosters to learning assignments, then match completions and overdue cases back to the same stable learner identifiers; explain leave, termination, duplicates, and every unassigned or unresolved person.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Employees and covered contractors learn the security and privacy behaviors expected of them during onboarding and at least annually, with overdue training actively followed through to completion.
Compare the documented owner with the intended role (HR Owner / IT / CISO), then compare dated records with the stated cadence: Upon hire/change/termination; annual as applicable.
Reconcile active personnel and all period starts from HR and contractor rosters to learning assignments, then match completions and overdue cases back to the same stable learner identifiers; explain leave, termination, duplicates, and every unassigned or unresolved person.
The active learner population, current onboarding and annual course assignments, latest course version, and all overdue or exempted assignments outstanding on the examination date.
Every employee and covered-contractor start during the review period, every annual awareness assignment issued to the active in-scope population, and every overdue escalation or exemption resolved during the period.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Shows which in-scope people completed the assigned onboarding or annual course, which version they took, and whether they met the applicable due date.
For each selected record, confirm it demonstrates Shows that awareness training was assigned and tracked as part of a named starter’s onboarding rather than waiting for the next annual campaign.
For each selected record, confirm it demonstrates Shows that late assignments were identified, escalated to accountable managers, and resolved or formally exempted rather than removed from the report.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.