polara labs

Templates · 5 min read

The security training log, one row per completion

Every training completion with its date and proof, and a summary of who is still due.

A security awareness training log is one row per person per training: the course, the completion date and where the certificate or export lives. A summary sheet shows who is trained and who is overdue.

The workbook is below, sheet by sheet. Fill it from your training tool's export so the dates match what the tool recorded.

The template in full

Below is the whole workbook as it downloads. Every bracketed field, such as [Company name], is a detail to fill in before you adopt it. There is no form and no email address to hand over, and the file is yours to edit.

Security Training Log

Completions

Each row is one training completed by one person at [Company name]. New hires complete security training within 30 days of their start date, and everyone repeats it every twelve months.

EmployeeRoleStart dateTrainingCompleted onScore or resultCertificate or proof linkDue byStatus

The sheet starts empty: one row per entry, under these columns.

Summary

Complete this at the end of each quarter and at the end of the audit period. Auditors look for a completion rate of 100 percent, or a documented reason for each exception.

MeasureValueHow to fill it in
PeriodThe quarter or audit period covered, for example Q1 2027.
HeadcountEmployees and contractors with access to company systems during the period.
CompletedPeople with a Complete row for the training due in this period.
Completion rateCompleted divided by Headcount, as a percentage. Explain every person not complete in the notes below.
ExceptionsNames and reasons for anyone overdue, and the date they will complete.

How to use

  1. [People owner role] owns this log and [Security owner role] chooses the training content.
  2. Every new employee and contractor completes security awareness training within 30 days of their start date. Set Due by to the start date plus 30 days.
  3. Everyone completes annual security training within twelve months of their last completion. Set Due by accordingly.
  4. Run at least one phishing exercise a year and record each person's result. Anyone who fails completes a short follow-up training.
  5. Free options work: a recorded internal session with a sign-in sheet, a short quiz in Google Forms or Microsoft Forms, or free courses from the Cybersecurity and Infrastructure Security Agency (CISA) or the SANS Institute security awareness resources.
  6. For evidence, keep the completion certificate, a screenshot of the training platform showing the name and date, or the quiz response export. Store it in one shared folder and paste the link in the proof column.
  7. Check the Status column monthly. Mark rows Overdue when Due by has passed and follow up with the person and their manager.

What an auditor checks

An auditor picks people from the period and looks each one up here. They want a completion before or soon after the start date and another within the last year, each with proof behind it.

Missing rows are findings, and so are dates that cannot be backed by an export or a certificate. The security awareness program sets the cadence this log is checked against.

Which criteria it maps to

It supports CC1.4 and CC2.2.1 A template is evidence of intent. The examination tests whether the control operated over the period, so keep the dated records the workbook produces. Every criterion, explained one by one, is on the Trust Services Criteria page.

Questions

What should a security training log record?
The person, the course, the completion date and where the proof is kept. A headcount summary helps show the population is complete.
Is a spreadsheet enough as a training record?
Yes, when each row can be backed by proof such as a completion export or certificate. The spreadsheet is the index; the proof is the evidence.
Who keeps the training log?
Usually whoever runs people operations or security. Name them in the log so an auditor knows who to ask.

Sources

  1. TSP Section 100, Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy AICPA. The criteria themselves, including the common criteria every SOC 2 report covers.

Related

Get audit-ready without a compliance team.

The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.

Take the free assessment

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.