Governance / Workforce
Personnel and contractors follow documented standards of conduct, acceptable use, confidentiality, privacy, and security responsibilities; deviations are reported and addressed.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Employees and contractors understand expected conduct, acceptable use, confidentiality, privacy, and security duties, while the organization can show that concerns and violations are handled consistently.
First SOC 2 program
Publish a concise code of conduct and acceptable-use rules, collect a signed acknowledgment during onboarding, and give people a confidential way to raise a concern. The founder or designated people lead should document how each reported issue was assessed and resolved.
As the company scales
Use the workforce system to automate acknowledgments for employees and contractors, run annual recertification, manage investigations in a restricted case system, and periodically reconcile completion against the active workforce roster.
Identify employees, temporary workers, interns, and contractors who can access company systems or information and decide which rules apply to each group.
You should end up with: A population definition that can be reconciled to current workforce and contractor records.
Document expected behavior, acceptable use, confidentiality, privacy, security reporting, conflicts of interest, consequences, and protection against retaliation.
You should end up with: Approved, versioned standards that personnel can access.
Make acknowledgment part of onboarding and repeat it after material updates or on the chosen annual cadence.
You should end up with: Dated acknowledgment records tied to individual personnel records and the policy version accepted.
Offer at least one confidential channel, explain when to use it, and assign trained people to receive and triage reports.
You should end up with: Published reporting instructions and an access-controlled intake log.
Record the allegation, scope the investigation, preserve relevant facts, determine the outcome, and apply corrective or disciplinary action through the appropriate leaders.
You should end up with: A restricted case record showing dates, reviewers, findings, decisions, and closure.
Compare acknowledgment completion with the active workforce and contractor list, follow up on exceptions, and report unresolved gaps to management.
You should end up with: A dated completion report with documented follow-up for missing acknowledgments.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Documents that define the control, its scope, ownership, and expected way of working.
Confirm what the record proves
The organization communicated enforceable conduct, acceptable-use, confidentiality, privacy, security-reporting, and consequence expectations to the covered workforce.
Include this context
policy version
Include this context
effective date
Include this context
covered population
Include this context
required conduct and reporting duties
Include this context
approver
Weak evidence to avoid
A generic internet-use document with no confidentiality duties, incident-reporting route, covered contractor population, approver, or effective date.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Covered personnel affirmatively received and accepted the applicable conduct rules at onboarding, annual recertification, or policy change.
Include this context
person identifier
Include this context
worker type
Include this context
policy version
Include this context
acknowledgment date
Include this context
completion status
Weak evidence to avoid
A completion total of 96 percent with no person-level records, contractor population, policy version, or way to identify the missing four percent.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Reported concerns entered a confidential intake process, received appropriate triage and investigation, and reached a documented outcome while sensitive details remained restricted.
Include this context
case identifier
Include this context
received date and channel
Include this context
issue category
Include this context
assigned investigator
Include this context
status and resolution date
Include this context
restricted evidence location
Weak evidence to avoid
An email stating that a concern was handled with no case identifier, intake date, investigator, documented disposition, or restricted case record.
Confirm what the record proves
Confirmed conduct deviations resulted in a reviewed, authorized, and consistently documented corrective or disciplinary response.
Include this context
case or deviation identifier
Include this context
substantiated finding
Include this context
decision authority
Include this context
action and effective date
Include this context
completion confirmation
Weak evidence to avoid
A manager message saying an employee was spoken to, without the related finding, decision authority, action date, or completion record.
Type 1
The current approved conduct and acceptable-use rules, current reporting channels, acknowledgment workflow configuration, and point-in-time acknowledgment reconciliation as of the examination date. If a conduct concern exists, include a current case record showing the configured intake, investigation, decision, and closure path; if none exists, include a complete zero-result query across every reporting channel and the restricted case system plus a walkthrough of a representative concern through that same path.
Type 2
All employees, contractors, interns, and temporary workers subject to acknowledgment during the review period, plus all ethics or conduct reports received and all resulting disciplinary actions during that period.
Reconcile acknowledgment records to dated employee and contractor rosters, then reconcile reporting-channel intake logs to restricted case records and any disciplinary actions, documenting legitimate exclusions and privacy-preserving identifiers.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Employees and contractors understand expected conduct, acceptable use, confidentiality, privacy, and security duties, while the organization can show that concerns and violations are handled consistently.
Compare the documented owner with the intended role (Executive Management / HR Owner), then compare dated records with the stated cadence: Upon hire, annually, and as needed.
Reconcile acknowledgment records to dated employee and contractor rosters, then reconcile reporting-channel intake logs to restricted case records and any disciplinary actions, documenting legitimate exclusions and privacy-preserving identifiers.
The current approved conduct and acceptable-use rules, current reporting channels, acknowledgment workflow configuration, and point-in-time acknowledgment reconciliation as of the examination date. If a conduct concern exists, include a current case record showing the configured intake, investigation, decision, and closure path; if none exists, include a complete zero-result query across every reporting channel and the restricted case system plus a walkthrough of a representative concern through that same path.
All employees, contractors, interns, and temporary workers subject to acknowledgment during the review period, plus all ethics or conduct reports received and all resulting disciplinary actions during that period.
Documents that define the control, its scope, ownership, and expected way of working.
For each selected record, confirm it demonstrates The organization communicated enforceable conduct, acceptable-use, confidentiality, privacy, security-reporting, and consequence expectations to the covered workforce.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Covered personnel affirmatively received and accepted the applicable conduct rules at onboarding, annual recertification, or policy change.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Reported concerns entered a confidential intake process, received appropriate triage and investigation, and reached a documented outcome while sensitive details remained restricted.
For each selected record, confirm it demonstrates Confirmed conduct deviations resulted in a reviewed, authorized, and consistently documented corrective or disciplinary response.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.