Can the team perform the work it owns
An engineer has been assigned to restore the production database if the service fails. They understand the application and have read the recovery procedure, but they have never restored this database from a backup. The engineer who wrote the procedure is leaving next month.
Management has assigned responsibility. It still needs to establish whether someone can carry out that responsibility when it matters.
SOC 2 CC1.4 addresses the competence behind those assignments. In plain language, the organization needs to attract, develop, and retain people who can perform the work needed to meet its objectives. The AICPA Trust Services Criteria provide the authoritative wording.
For a service provider, competence affects whether people configure systems safely, recognize incidents, evaluate exceptions, and protect customer information. A well-written procedure can fail when the person performing it lacks experience or cannot obtain qualified help.
This is the fourth article in our SOC 2 Guide. The company examples are hypothetical. Choose an approach based on your services, risks, and obligations; headcount alone does not determine the controls you need.
Define competence in terms of the work
Start with activities important to the service and identify what a person must understand to perform them. A job title or certification can provide useful context, but neither explains how someone will handle your particular systems.
For the recovery role, useful expectations might include selecting the correct backup, restoring it into an appropriate environment, checking data integrity, and recognizing when the recovery has failed. A support employee handling customer exports needs different skills, including verifying authorization and choosing an approved delivery method.
Record these expectations where managers will use them. A small company might add specific requirements to its role descriptions. A larger organization might maintain a skills matrix that connects roles to required abilities and identifies who evaluates them.
The CC1.4 points of focus address competence expectations, evaluation and development, retention, and continuity when key people are unavailable. Additional considerations include relevant background checks and technical skills. These points help interpret the criterion; they do not prescribe a particular certification, training product, or personnel process for every company.
Include contractors and other external personnel whose work supports the service. A contractor responsible for database changes needs relevant experience with the platform and an understanding of the company's review process. Someone inside the company should be able to evaluate the work or obtain qualified help.
Evaluate ability before relying on it
Use evidence relevant to the responsibility. Depending on the role, that might include a structured interview, a work sample, supervised performance, or discussion of a realistic scenario. Verify claimed qualifications when they materially affect the decision.
Select hiring and background screening steps according to the role's access and responsibilities. Consult HR or legal advisers about applicable requirements and limits, particularly when hiring across jurisdictions. A screening result should be handled through the appropriate personnel process, with restricted access to candidate information.
For existing personnel, consider what has changed. Someone proficient with one cloud platform may need support after a migration. A reliable individual contributor may need additional experience before approving other people's changes or directing an incident response.
When an assessment identifies a gap, decide how the work will be handled while the person develops. Additional review, temporary reassignment, targeted instruction, or specialist support may be appropriate. Name the person who will evaluate improvement and describe what would demonstrate readiness.
Give people a chance to demonstrate learning
A course completion record shows that a learning activity occurred. To understand whether it prepared someone for a particular task, ask them to perform the task or explain a relevant decision.
For example, a developer could review a recent authorization defect and explain how a proposed fix prevents one customer from accessing another customer's records. A support team could practice identifying a request that needs approval before data is released. Record gaps revealed by the exercise and follow up on the coaching provided.
NIST SP 800-50 Revision 1 offers supporting guidance on cybersecurity and privacy learning programs, including role-based learning and evaluation. It can help with program design without adding requirements to a SOC 2 examination.
Give employees time to practice and managers time to assess their progress. Consider whether workloads, limited supervision, or persistent vacancies prevent qualified people from doing the work reliably. Training alone will not resolve a staffing shortfall.
Retention and continuity deserve attention as well. When qualified people leave repeatedly, examine causes such as unsustainable workloads, limited development, or lack of support. Use those findings to guide staffing and retention decisions.
Find out where essential work depends on one person. Arrange coverage, document the procedure, and let the replacement practice before an absence makes the dependency urgent. Revisit that coverage when systems or responsibilities change.
A bootstrapped company with five people
Consider two founders and three employees running a software service. One founder leads engineering; the other handles commercial and operational responsibilities. The team cannot justify a full-time specialist for every security task.
They begin with a short list of important responsibilities and identify who can perform each one. During that discussion, they discover that only the engineering founder has restored the database. One employee has relevant experience but has never used the company's recovery process.
The founder supervises a restoration in an isolated environment, using appropriately protected data. The employee discovers that one step assumes knowledge of a particular encryption setting. They correct the instructions, repeat the exercise, and document how the restored data was checked. They also establish when to call an outside specialist if a recovery exceeds their experience.
For an upcoming application assessment, the founders evaluate a contractor's relevant experience and agree on the work and expected deliverables. One founder remains responsible for reviewing the results and arranging follow-up. If neither founder can evaluate a significant technical conclusion, they obtain qualified assistance.
Evidence to keep: role expectations, relevant experience assessments, the restoration exercise record, revised instructions, follow-up coaching, and the contractor's assessed qualifications. A concise record can work when it explains what was evaluated and the resulting decision.
This arrangement may suit a relatively simple service. A five-person company handling highly sensitive information or operating a complex platform may need more extensive specialist support and coverage.
Developing capability at 100 people
A hypothetical service provider with 100 people has separate engineering, support, and operations teams. Hiring managers use common role descriptions, while department leaders identify skills needed for the services they operate.
Suppose the company introduces a new cloud environment. The operations manager compares the team's experience with the tasks the new service requires. Two engineers receive focused instruction, practice configuration changes under review, and demonstrate recovery procedures before joining the primary support rotation.
HR tracks agreed development activities, but technical managers evaluate whether people can perform the relevant work. When an employee changes roles, the receiving manager checks the new responsibilities instead of relying on an earlier onboarding record.
The company also identifies deputies for important control owners. A planned absence provides an opportunity to check whether a deputy can complete the work with the documentation, authority, and approved access available. Any gap becomes a specific development or coverage action.
Evidence to keep: approved role descriptions, hiring assessments, role-change reviews, relevant learning records, practical evaluations, and coverage arrangements. Preserve dates and resulting decisions so a reviewer can distinguish planned development from demonstrated capability.
Maintaining competence across 1000 people
At a hypothetical 1,000-person company, decentralized hiring and acquisitions can create uneven expectations. A central people team could maintain common requirements while business leaders define additional competencies for their services.
For example, a newly acquired unit may use a different incident-management platform and escalation process. Its employees might be experienced responders yet unfamiliar with the parent company's customer commitments. Joint exercises can reveal where that unfamiliarity affects decisions and which teams need additional preparation.
Management could review important vacancies, dependence on individual experts, and overdue development plans by business unit. A vacancy in a critical role deserves attention even when the companywide training completion rate looks healthy. The review should lead to decisions about interim coverage, development, recruitment, or the work the company can safely take on.
Include outsourced teams where their work supports the service. Define which capabilities the provider maintains, how material staffing changes are communicated, and what evidence the organization needs to evaluate the arrangement. Avoid routinely collecting unnecessary personal records about every vendor employee.
Evidence to keep: common and local role requirements, completed assessments, exercise results, management reviews of capability gaps, and actions addressing staffing or succession risks. Keep enough supporting detail to show what changed after management identified a problem.
Preserve the history through the examination period
A SOC 2 Type 2 examination evaluates the suitability of control design and operating effectiveness over a specified period. The AICPA SOC 2 examination guide explains the professional framework.
Retain relevant role versions, hiring and transfer dates, actual training dates, evaluations, and records showing how identified gaps were addressed. Keep the employee and contractor populations needed to explain who was covered by the particular control.
If training was late, preserve the original deadline and actual completion date. Explain any interim supervision or reassignment accurately. A course completed near period-end does not establish that the activity occurred earlier or that the person already had the necessary skills.
Choose review frequencies according to changing responsibilities and exposure. CC1.4 does not prescribe one annual training schedule, certification, or assessment format for every organization. Discuss evidence needs with the examining CPA firm and protect confidential personnel records when providing access. These examples do not guarantee an audit outcome.
Begin with an important dependency
Choose one responsibility currently dependent on a single person. Identify a backup, arrange a supervised exercise, and address what it reveals. Keep a record of the result and check that the replacement can perform the task with the approved resources available.
CC1.3 established how authority and responsibility are organized. CC1.4 addresses the capability to carry out those assignments. The next article, CC1.5, examines how management holds people accountable for the work.
Support for your SOC 2 program
Genius GRC helps organizations develop practical controls and organize supporting evidence. Discuss your SOC 2 needs with us to identify skills, development, and coverage arrangements suited to your services, risks, and resources.
Explore the SOC 2 Guide for the full series.
This article provides general guidance. Adapt the examples to your examination scope and obligations with your advisers and auditor.