Commitment to attracting, developing and retaining competent people

frameworkSOC 2 (Trust Services Criteria) sectionCC1 Control environment csf 2.0PR.AT-01 PR.AT-02 topicsAwareness & Training frameworks0 10 3

Official text · not licensableSummary (ControlMapping's wording): Commitment to attracting, developing and retaining competent people. The criterion text is AICPA's copyright.

gap from SOC 2 → gap to SOC 2 →

Wrong or missing mapping? Report it

Equivalents of CC1.4 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AT-01 PR.AT-02	Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind; Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind	Editorial	Same topic: Awareness & Training (editorial pick)
ISO 27001	A.6.3 Clause 7.3 A.6.1 Clause 7.2	Information security awareness, education and training; Awareness…	Editorial	Same topic: Awareness & Training (editorial pick) ControlMapping editorial: Commitment to competence: ISO covers it as competence (7.2), screening (A.6.1) and awareness and training (A.6.3). 1 loosely related (not mappings) A.5.2 Information security roles and responsibilities Loosely related Only shares CSF PR.AT-02: related, not a mapping
CIS v8.1	CIS 14.1 CIS 14.2 CIS 14.3 CIS 14.4 CIS 14.5 CIS 14.6 CIS 14.7 CIS 14.8 CIS 14.9	Establish and Maintain a Security Awareness Program; Train Workforce Members to Recognize Social Engineering Attacks…	Editorial	Same topic: Awareness & Training (editorial pick)
PCI DSS	12.6.1 12.6.3	Formal security awareness programme; Awareness training on hire and at least annually	Editorial	Same topic: Awareness & Training (editorial pick) 3 loosely related (not mappings) 6.2.2 Developers trained in secure software development Loosely related Only shares CSF PR.AT-02: related, not a mapping 12.10.4 Incident response staff trained Loosely related Only shares CSF PR.AT-02: related, not a mapping 12.10.4.1 Training frequency set by targeted risk analysis Loosely related Only shares CSF PR.AT-02: related, not a mapping
CMMC	AT.L2-3.2.1 AT.L2-3.2.2 AT.L2-3.2.3	Role-Based Risk Awareness; Role-Based Training…	Editorial	Same topic: Awareness & Training (editorial pick)
800-53	AT-2 AT-3	Literacy Training and Awareness; Role-based Training	Editorial	Same topic: Awareness & Training (editorial pick)
HIPAA	§164.308(a)(5)§164.308(a)(5)(ii)(A)	Security Awareness and Training; Security Reminders	Editorial	Same topic: Awareness & Training (editorial pick) 3 loosely related (not mappings) §164.308(a)(5)(ii)(B) Protection from Malicious Software Loosely related Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(C) Log-in Monitoring Loosely related Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(D) Password Management Loosely related Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping
GDPR	Art.39(1)(b)	Tasks of the data protection officer	Editorial	Same topic: Awareness & Training (editorial pick)
NIS2	8.1 8.2 10.2	Awareness raising and basic cyber hygiene practices; Security training…	Editorial	Same topic: Awareness & Training (editorial pick) ControlMapping editorial: Background verification: SOC 2's commitment to competence includes screening; NIS2 point 10.2 requires background checks where appropriate. 3 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF PR.AT-02: related, not a mapping 1.2 Roles, responsibilities and authorities Loosely related Only shares CSF PR.AT-02: related, not a mapping 10.1 Human resources security Loosely related Only shares CSF PR.AT-02: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(4)Art.13(6)	Governance and organisation; Learning and evolving	Editorial	Same topic: Awareness & Training (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.