Commitment to competence
You have named the engineer who will restore your production database during an outage. They know the application and have read the recovery procedure. Then you ask when they last restored this database from a backup. They have never done it, and the engineer who wrote the instructions leaves next month.
That is a useful discovery to make while you still have time to act. SOC 2 CC1.4 asks you to look at whether your people can perform the work you rely on them to do, and how you attract, develop, and retain that capability.
The AICPA Trust Services Criteria provide the authoritative wording. For your service, competence affects how people configure systems, recognize incidents, evaluate exceptions, and protect customer information. Even a careful procedure can fail when the person using it lacks experience or cannot get qualified help.
This is the fourth article in our SOC 2 Guide. The company scenarios are fictional. Use them to think through your services, risks, and obligations rather than assume headcount determines the controls you need.
Describe the ability your work requires
Start with an important responsibility and describe what someone needs to do well. For database recovery, that might mean selecting the right backup, restoring it in an appropriate environment, checking data integrity, and recognizing when recovery has failed. For a support employee sending customer exports, it means checking authorization and using an approved delivery method.
Put those expectations where your managers will use them. You might add them to role descriptions or maintain a skills matrix that shows the required abilities and who evaluates them. A title or certification can be useful background, but you still need to understand how someone will handle your systems.
The CC1.4 points of focus address competence expectations, evaluation and development, retention, and continuity when key people are unavailable, with relevant considerations such as background checks and technical skills. They help you interpret the criterion without prescribing one certification or personnel process for every business.
Include contractors and other external personnel supporting your service. If a contractor changes your database, check their relevant platform experience and understanding of your review process. Make sure someone inside your company can evaluate their work or obtain qualified assistance.
Evaluate people against the responsibility
Choose evidence that tells you something useful about the role. A structured interview, work sample, supervised task, or realistic scenario may help. Verify claimed qualifications where they materially affect your decision.
Choose hiring and background-screening steps around the role’s access and responsibilities. Work with HR or legal advisers on applicable requirements and limits, especially across jurisdictions, and restrict access to candidate information.
Keep evaluating as the work changes. Your engineer may know one cloud platform well and need support after a migration. Your strongest individual contributor may need practice before approving other people’s changes or leading an incident response.
When you find a gap, decide how the work will be covered during development. You might add review, temporarily reassign the task, provide focused instruction, or bring in specialist help. Name who will assess progress and what will demonstrate readiness.
Give learning a practical follow-through
After a course, ask the person to apply what they learned. A developer could explain how a fix prevents one customer from seeing another customer’s records. A support team could practice recognizing a data request that needs approval. Record the gaps and follow up on the coaching.
NIST SP 800-50 Revision 1 offers useful guidance on cybersecurity and privacy learning programs, including role-based learning and evaluation. You can use it to inform your program without treating it as an additional SOC 2 requirement.
Give people time to practice and managers time to assess them. Look at workload, supervision, and vacancies too. More training will not resolve a staffing shortfall. If experienced people keep leaving, examine the causes and use what you learn in your staffing and retention decisions.
Find responsibilities that depend on one person. Document the procedure, arrange coverage, and let the replacement practice before an absence makes the dependency urgent. Revisit the arrangement when systems or duties change.
Applying CC1.4 at five people
Imagine you and your cofounder run a software service with three employees. Your cofounder leads engineering; you manage customers and operations. You cannot hire a full-time specialist for every security task, so you make a short list of important responsibilities and who can perform them.
You discover that only your cofounder has restored the database. An employee has relevant experience, so you arrange a supervised restore in an isolated environment with appropriately protected data. During the exercise, they find an instruction that assumes knowledge of an encryption setting. Together, they correct it, repeat the exercise, and record how they checked the restored data.
You could keep the exercise record and updated procedure organized through Vanta’s document workflow. The practical evaluation tells you whether the employee is ready, and you agree when to call an outside specialist if a recovery exceeds the team’s experience.
For an upcoming application assessment, check the contractor’s relevant qualifications and agree on deliverables. One founder owns review and follow-up. If neither of you can evaluate a significant technical conclusion, obtain qualified help.
Evidence to keep: role expectations, experience assessments, the restore exercise, revised instructions, coaching, and assessed contractor qualifications. This may fit a relatively simple service; a small company with a complex platform or highly sensitive data may need more specialist support and coverage.
Applying CC1.4 at 100 people
Now imagine your company has engineering, support, and operations teams and is introducing a new cloud environment. Your operations manager compares current experience with the new tasks before assigning the primary support rotation.
Two engineers receive focused instruction, practice changes under review, and demonstrate recovery procedures. HR helps track development activity, while the technical manager evaluates whether they can do the work. When someone transfers into the team, the receiving manager checks the new responsibilities rather than relying on an old onboarding record.
You can use Vanta’s personnel training tasks to support assigned security or privacy training, with records appropriate to your configured training source. Keep the role-specific practical assessment alongside that learning history so you can distinguish course completion from demonstrated capability.
A planned absence gives you a chance to test deputies for important control owners. Check whether each deputy has the documentation, authority, and approved access to carry out the work. Turn any gap into a specific development or coverage action.
Evidence to keep: approved role descriptions, hiring assessments, role-change reviews, learning records, practical evaluations, and coverage arrangements. Preserve dates and decisions so planned development is clearly distinguishable from readiness.
Applying CC1.4 at 1,000 people
Picture an acquisition bringing experienced incident responders into your company. They know their own platform, but they have not worked with your escalation process or customer commitments. A joint exercise reveals that they would escalate a significant incident later than your service obligations allow.
Your central people team maintains common role expectations while business leaders define the skills their services need. The exercise leads to focused preparation and another check of the response. You also review critical vacancies, reliance on individual experts, and overdue development plans by business unit.
Use relevant Vanta training records and organized assessment documents to support that review, within the capabilities and permissions of your setup. Look beyond companywide completion figures: a critical vacancy still needs a decision about coverage, recruitment, development, or the work you can safely take on.
Include outsourced teams supporting the service. Agree on the capabilities the provider maintains, how you learn about material staffing changes, and what evidence lets you evaluate the arrangement. Avoid collecting unnecessary personal records about every vendor employee.
Evidence to keep: common and local role requirements, assessments, exercise results, management reviews, and actions addressing capability or succession gaps. Show what changed after management identified the problem.
Keep the history through your examination period
A SOC 2 Type 2 examination evaluates control design and operating effectiveness over a specified period. The AICPA SOC 2 examination guide explains the professional framework.
Retain relevant role versions, hiring and transfer dates, actual training dates, evaluations, and follow-up on gaps. Keep the employee and contractor populations needed to show who the control covered.
If training was late, retain the original deadline and actual completion date. Explain interim supervision or reassignment accurately. A course completed near period-end cannot establish earlier completion or competence.
Choose review frequencies around changing responsibilities and exposure. CC1.4 does not prescribe one annual schedule, certification, or assessment format. Discuss evidence needs with your examining CPA firm and protect confidential personnel records. These examples do not guarantee an audit outcome.
Start with a dependency you can reduce
Choose an important task that currently depends on one person. Name a backup, arrange a supervised exercise, and act on what you discover. Keep the result and check that the replacement can perform the task with the approved resources available. You will leave with a clearer understanding of your coverage.
CC1.3 addresses authority and responsibility. CC1.4 helps you establish capability, and CC1.5 examines accountability for doing the work.
Support for your SOC 2 program
At Genius GRC, we help you develop practical controls and organize supporting evidence. Discuss your SOC 2 needs with us to work through skills, development, and coverage suited to your services, risks, and resources.
Explore the SOC 2 Guide for the full series.
This article provides general guidance. Adapt the examples to your examination scope and obligations with your advisers and auditor.