Personnel are trained and demonstrate the competence to meet security responsibilities

What an auditor asks for

An assessor samples people in security-relevant roles and checks that role-specific training finished before they worked unsupervised.

• Training completion export
• Role curriculum

Evidence ShipReady collects for CC1.4

ShipReady maps CC1.4 to the engineering signals below. A control with no collected artifact stays a gap until an evidence run produces one — never an assumed pass.

• Database posturetraining-awareness

Common gaps

• No artifact has been collected yet — ShipReady records the CC1.4 control as a gap until an evidence run produces one, never as an assumed pass.
• The connected source is unconfigured or has returned no posture, so the automated check cannot run (an unconfigured collector is a gap the owner can close).
• The supporting record exists but was not reviewed in the current audit period, so the evidence has lapsed.