Security Training Log Guide
Track onboarding and annual security training completion for SOC 2 CC1.4 evidence.
Security Training Completion Log
Track onboarding and annual security training completion for SOC 2 CC1.4 evidence.
How to Fill Out This Security Training Completion Log
Security training log template — Log every employee and contractor with a completion date and course name. Sample rows are examples — delete before audit.
Recommended Owner: HR or Security | Managers chase overdue training
What this file is for
Document purpose
Evidence of security training completion (CC1.4).
In your program: One row per person per training event; tie to COR-006 requirements.
Before you start
Getting Started
- Enable Editing; start on the Instructions sheet for tab order and version metadata.
- Use dropdowns only in validated columns; delete gray sample rows before auditor samples.
- Check Dashboard after data entry — formulas summarize completion and risk.
Document tour
Fill out the file section by section
Work through the sections below in order. Each block matches a heading or tab in the downloaded SOC-006 file.
Instructions
- List required courses and completion deadlines on Instructions tab.
- After editing Instructions, search for `[` placeholders and gray sample names — auditors flag incomplete templates.
Role Requirements
- Map each role (Engineering, Sales, etc.) to required courses — drives Training Log expectations.
- Align with COR-006 required topics and HR-001 onboarding assignments.
Department / Role
- Fill Department / Role for every in-scope row on Role Requirements — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Training Type
- Fill Training Type for every in-scope row on Role Requirements — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Frequency
- Fill Frequency for every in-scope row on Role Requirements — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Required?
- Fill Required? for every in-scope row on Role Requirements — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Record ID
- Assign stable Record ID values — never reuse an ID for a different record in the audit period.
- Cross-reference IDs in related toolkit docs (SOC-021, COR-014, HR-001, etc.).
Employee ID
- Assign stable Employee ID values — never reuse an ID for a different record in the audit period.
- Cross-reference IDs in related toolkit docs (SOC-021, COR-014, HR-001, etc.).
Employee Name
- Fill Employee Name for every in-scope row on Role Requirements — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Department
- Fill Department for every in-scope row on Role Requirements — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Hire Date
- Use consistent Hire Date format (YYYY-MM-DD) aligned with HRIS, IdP, or LMS exports.
- Dates must match supporting evidence — auditors compare log timestamps to HR records.
Completed Date
- Use consistent Completed Date format (YYYY-MM-DD) aligned with HRIS, IdP, or LMS exports.
- Dates must match supporting evidence — auditors compare log timestamps to HR records.
Expiration Date
- Use consistent Expiration Date format (YYYY-MM-DD) aligned with HRIS, IdP, or LMS exports.
- Dates must match supporting evidence — auditors compare log timestamps to HR records.
Score (%)
- Fill Score (%) for every in-scope row on Role Requirements — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Status
- Select Status from the dropdown — free text breaks Dashboard formulas and heatmaps.
- Update through the lifecycle (Not Started → In Progress → Complete/Closed) before sign-off.
New Hire Compliant?
- Select New Hire Compliant? from the dropdown — free text breaks Dashboard formulas and heatmaps.
- Update through the lifecycle (Not Started → In Progress → Complete/Closed) before sign-off.
Training Provider
- Fill Training Provider for every in-scope row on Role Requirements — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Policies Acknowledged
- Fill Policies Acknowledged for every in-scope row on Role Requirements — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Training Log
- One row per person per course: employee, course, completion date, method (LMS/live).
- Match HR-001 row 4 assignments for new hires; delete gray sample rows.
Record ID
- Assign stable Record ID values — never reuse an ID for a different record in the audit period.
- Cross-reference IDs in related toolkit docs (SOC-021, COR-014, HR-001, etc.).
Employee ID
- Assign stable Employee ID values — never reuse an ID for a different record in the audit period.
- Cross-reference IDs in related toolkit docs (SOC-021, COR-014, HR-001, etc.).
Employee Name
- Fill Employee Name for every in-scope row on Training Log — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Department
- Fill Department for every in-scope row on Training Log — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Hire Date
- Use consistent Hire Date format (YYYY-MM-DD) aligned with HRIS, IdP, or LMS exports.
- Dates must match supporting evidence — auditors compare log timestamps to HR records.
Training Type
- Fill Training Type for every in-scope row on Training Log — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Completed Date
- Use consistent Completed Date format (YYYY-MM-DD) aligned with HRIS, IdP, or LMS exports.
- Dates must match supporting evidence — auditors compare log timestamps to HR records.
Expiration Date
- Use consistent Expiration Date format (YYYY-MM-DD) aligned with HRIS, IdP, or LMS exports.
- Dates must match supporting evidence — auditors compare log timestamps to HR records.
Score (%)
- Fill Score (%) for every in-scope row on Training Log — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Status
- Select Status from the dropdown — free text breaks Dashboard formulas and heatmaps.
- Update through the lifecycle (Not Started → In Progress → Complete/Closed) before sign-off.
New Hire Compliant?
- Select New Hire Compliant? from the dropdown — free text breaks Dashboard formulas and heatmaps.
- Update through the lifecycle (Not Started → In Progress → Complete/Closed) before sign-off.
Training Provider
- Fill Training Provider for every in-scope row on Training Log — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Policies Acknowledged
- Fill Policies Acknowledged for every in-scope row on Training Log — use dropdowns where provided.
- Do not leave cells blank for active records; use N/A with a short reason if truly not applicable.
Evidence Link
- Fill Evidence Link with a URL, ticket, or export path auditors can open — not a local-only path.
- Re-verify links before fieldwork; broken evidence links are a common audit finding.
Quality check
Before You Finalize
- 100% in-scope staff have onboarding + annual row.
- Sample rows deleted.
Evidence
Where to Store It
- Store the completed file in your compliance evidence folder (signed PDF for policies).
- Register the document in COR-013 with version, owner, and next review date.
- Link the file from your evidence index or SOC-005 project plan when you use Phase 3 trackers.