For SaaS, SOC 2 is the ticket to enterprise deals. Security awareness is investigated under Common Criteria (CC) 2.2.
The Auditors Checklist
Onboarding Evidence: Proof new hires trained in Week 1.
Annual Refresher: Proof the workforce re-trained this year.
Policy Acceptance: Signed acknowledgments of the InfoSec Policy.
Ongoing Awareness: Monthly simulations/newsletters (The 'Extra Credit').
Common Pitfall: The Gap
Hiring an employee in June but not training them until December creates a "control gap" that auditors hate. Automate onboarding to fix this.
Contractors Count
Don't forget contractors! If they have access to production data, they are in scope for the audit.
Conclusion
SOC 2 is about trust. Your awareness program demonstrates to your customers (and their auditors) that your employees are competent stewards of their data.
