SOC 2 CC1.4: hiring and competence, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For CC1.4, the usual records are these.

• Background check confirmations for new hires
• Security awareness training completion records
• Job descriptions or a hiring checklist

What Polara asks about it

The free readiness assessment asks 4 questions that bear on CC1.4. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Background checks completed before start? If yes, show it: background check report (redacted), offer letter stating background check, background check status in your human resources system, or policy requirement excerpt. If no, the fix: add a background check to the pre-start checklist and retain the completion record.
• NDA signed at hire? If yes, show it: signed inventions and confidentiality agreement, signed non-disclosure agreement (redacted), confidentiality policy excerpt, or employee handbook section. If no, the fix: include a non-disclosure agreement in the offer package and retain the signed copy.
• Security awareness training at hire and annually? If yes, show it: security training completion report, learning platform export, phishing simulation summary, or training acknowledgement record. If no, the fix: assign security awareness training at hire and annually, and retain the completion record.
• Do you follow a documented offboarding checklist that records access revocation for each departure? If yes, show it: signed offboarding record, a completed offboarding ticket showing each system disabled with its timestamp, or a deprovisioning log for a departed employee. If no, the fix: adopt an offboarding checklist that records every access revocation, and retain the completed checklist for each departure.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Human Resources Security Policy covers CC1.4.

Free templates that help, printed in full with Word, PDF or Excel downloads:

• Security awareness training policy template
• Code of conduct template
• Security awareness program template
• Security training log template

If you also run ISO 27001, the Annex A controls A.6.1, background screening, A.6.2, employment terms and A.6.3, security training ask for overlapping evidence. One record can serve both when it names what it proves.

Where it goes wrong

One gap a remediation playbook covers here is security Awareness Training. The fix: enroll all employees in a security awareness training program. The proof: screenshot of training platform showing employee enrollment and completion status.

An auditor asks two things about it. Is there a documented security awareness training program? Are all employees enrolled in security training?

Is it in your scope?

Yes, always. CC1.4 is one of the 33 common criteria, and the common criteria are in every SOC 2 report, Type 1 or Type 2. The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Control environment: the criteria around it

CC1.4 is one of 5 criteria in control environment, CC1.1 to CC1.5. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• CC1.1, integrity and ethics
• CC1.2, board oversight
• CC1.3, structure and reporting
• CC1.4, this page
• CC1.5, accountability

Before it: CC1.3, structure and reporting. After it: CC1.5, accountability. All the criteria are on the Trust Services Criteria page, grouped by category.