COSO Principle 4 — Workforce Competence
Description
The entity attracts, develops, and retains competent individuals to support the security control framework, with defined skill requirements per role and ongoing training.
⚠️ Risk Impact
Security failures from competence gaps look identical to security failures from malice in incident reports — but the remediation paths differ entirely. Without documented competence requirements, you cannot demonstrate that security failures were not within reasonable foresight.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.
🔧 Remediation
Document role-based security competence requirements: which roles need which certifications, training, or demonstrable skills. Track completion in HRIS. Run annual security training with role-based modules. Document training requirements in job descriptions.
💀 Real-World Attack Scenario
A junior engineer with no cloud-IAM training deployed a service with cluster-admin privileges 'to get past a quota issue'. Three weeks later, that service was compromised through a dependency CVE. The attacker had cluster-admin from the first minute. Forensic review showed the engineer had no formal cloud-IAM competence requirement in their role description and had completed zero security trainings in the past 18 months.
💰 Cost of Non-Compliance
Untrained workforce breach exposure: 3.2× higher cost vs trained workforce (PwC 2024 AI Incident Cost Study). 64% of SOC 2 audits flag CC1.4 when investigating breach root causes that trace to staff competence. Insurance renewal denial rate where training isn't documented: 22% in 2024.
📋 Audit Questions
- 1.What security competence is required for engineering vs ops vs finance roles?
- 2.Show training completion records for the last 12 months across all roles.
- 3.What certifications are required for elevated permissions (e.g., production access)?
- 4.Walk me through how a new hire achieves security competence before getting production credentials.
- 5.Show one example of an employee whose access was held back pending training completion.
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Training as one-time onboarding only — no annual refresh as threat landscape changes
- ⛔Training that doesn't tie to access grants (anyone can request production credentials regardless of training)
- ⛔Generic security awareness training without role-specific deep-dives (engineers need different competence than finance teams)
📈 Business Value
Documented competence requirements transform security training from cost-center checkbox into measurable risk-reduction. Companies with documented role-based competence requirements report 47% fewer credential-related incidents (Mandiant 2024).
⏱️ Effort Estimate
20-40 hours initial competence-matrix authoring + 4 hours quarterly tracking
EchelonGraph integrates with HRIS to track competence vs access; alerts when elevated permissions exist without prerequisite training
🔗 Cross-Framework References
Automate SOC 2 CC1.4 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →