SOC 2 · CC - Common Criteria (Security)
SOC 2 SOC2-CC1.4: CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
SOC 2 SOC2-CC1.4 covers CC1.4 Attracting, developing and retaining competent people (COSO principle 4). The held text names 4 evidence records for it, the first being Background check policy and completed checks for a sample of new hires and contractors. The common gap an assessor flags is Background checks missing for contractors or vendor staff.
The organisation hires, develops and keeps people with the competence its objectives require. Points of focus: policies state the competence expected; competence of staff and outsourced providers is evaluated and shortfalls addressed; mentoring and training support recruitment and retention; succession is planned for roles important to control; backgrounds of staff, contractors and vendor employees are considered before hiring and retaining them; their technical competence is assessed; and ongoing training keeps technical skills current.
What evidence supports SOC2-CC1.4?
- Human resourcesBackground check policy and completed checks for a sample of new hires and contractors
- Human resourcesRole competency requirements and performance review records
- Human resourcesTechnical and security training records with completion rates
- Human resourcesSuccession or backup plan for key control owners
Where this requirement comes from
This is our own statement of SOC 2 SOC2-CC1.4, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Background checks missing for contractors or vendor staff
- No evidence technical staff received training in the period
- Single points of failure in key control roles with no succession plan
How it maps to ISO 27001:2022
- 6.1 medium Commitment to attract competent individuals implies hiring standards but not documented background screening.
- 6.3 medium Developing competent individuals covers training generally, not a security awareness programme.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.