CC1.4 Attracting, developing and retaining competent people (COSO principle 4)

The organisation hires, develops and keeps people with the competence its objectives require. Points of focus: policies state the competence expected; competence of staff and outsourced providers is evaluated and shortfalls addressed; mentoring and training support recruitment and retention; succession is planned for roles important to control; backgrounds of staff, contractors and vendor employees are considered before hiring and retaining them; their technical competence is assessed; and ongoing training keeps technical skills current.

Source: SOC 2 (2017 Trust Services Criteria), CC1.4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.