Aramco CCC & CCC+ · SACS-210
Your Aramco CCC or CCC+, prepared control by control
Aramco requires its vendors to hold a Cybersecurity Compliance Certificate. We prepare your company for it from start to finish: we help identify which certificate applies, close every gap against SACS-210, put the controls in place for real and assemble the evidence the audit firm will check.
Free tools · 1 minute
CCC or CCC+?
Answer six questions to find your likely SACS-210 classification and the certificate you need.
Find my classification →Check your domain’s public e-mail security records
SPF, DKIM, DMARC and private domain (TPC1.20, TPC1.23).
Indicative check — does not establish CCC compliance.
The essentials
What you need to know before you start
- Required
- Aramco asks all of its vendors to obtain the CCC in order to register and keep doing business with it.
- Full compliance
- All applicable controls must be met. Any gap must be resolved or addressed through the applicable formal waiver process.
- 2 years
- The certificate is valid for two years and is accepted across the Aramco group, including SABIC. Renewal is a new assessment.
- SACS-210
- The February 2026 edition of Aramco’s Third-Party Cybersecurity Standard, which replaces SACS-002.
Scope
Who must comply
SACS-210 covers a third party in any of these situations. One is enough.
- You process, transmit or store Aramco information or personal data.
- You have access to an Aramco computer or server.
- You supply off-the-shelf or customised software or technical products to Aramco.
- Your systems connect to the Aramco network.
- You provide consultancy on high-sensitivity national projects.
In practice, every vendor needs at least the CCC for the general requirements at registration.
CCC or CCC+
Two certificates, depending on your classification
The certificate you need depends on how you work with Aramco, for example whether you connect to its network or process its critical data. If both apply to you, only the CCC+ is accepted.
ImportantCritical Data Processors require CCC+. For Network Connectivity, confirm the required certificate with your Aramco proponent and selected authorised audit firm, as Aramco’s public guidance currently contains conflicting information.
-
CCC
Your company completes a self-assessment against SACS-210, then the authorised audit firm verifies it remotely.
Remote verification
-
CCC+
The authorised audit firm assesses your compliance on site, against the same standard. Required for Critical Data Processors.
On-site assessment
Classifications
Seven classifications in SACS-210
The general requirements apply to everyone. Each classification adds specific controls, and they add up when several apply. Your classification is confirmed with the Aramco department that owns your contract.
-
General requirements
The baseline for every third party: 33 controls.
-
Network Connectivity
Your infrastructure connects to the Aramco network (VPN, leased line).
CCC or CCC+: confirm
-
Outsourced & Managed Services
You run or support infrastructure or managed services for Aramco.
formerly Outsourced Infrastructure
-
Critical Data Processor
You develop, access or process confidential Aramco data.
CCC+
-
Software Services
You develop or host customised software, an application or a website.
formerly Customized Software
-
Cloud Computing
You provide IaaS, PaaS or SaaS.
-
Operational Technology
You supply, integrate or maintain OT systems (DCS, SCADA, PLC…).
new in SACS-210
- Find your classification in 1 minute
SACS-210 guide · General requirements
The 33 controls every Aramco supplier must meet
Whatever your classification, these general requirements apply. Each one is explained: what the standard asks for, how to implement it on Microsoft 365 or Google Workspace, and the evidence to prepare.
- Replaces SACS-002 (February 2026)
- Controls renumbered TPC1.x / TPC2.x
- New GOVERN and RECOVER functions
- OT becomes a classification
Govern · 7
- TPC1.1 Comply with Saudi cybersecurity and data privacy laws
- TPC1.2 Acceptable Use Policy (AUP)
- TPC1.3 Core cybersecurity policies and standards
- TPC1.4 Employee onboarding and offboarding process
- TPC1.5 Hold a valid CCC (or approved certificate)
- TPC1.6 Renew the CCC before it expires
- TPC1.7 Share client data only with contract personnel
Protect · 22
- TPC1.9 Centralised identity and access management
- TPC1.10 Unique credentials for every user
- TPC1.11 Password and passphrase rules
- TPC1.12 Multi-factor authentication (MFA)
- TPC1.13 Single sign-on only with MFA at first login
- TPC1.14 Annual review of accounts and access rights
- TPC1.15 Secure authentication for all technology assets
- TPC1.16 Return, then delete, client data at end of lifecycle
- TPC1.17 Secure disposal of end-of-life assets
- TPC1.18 Encryption at rest and in transit
- TPC1.19 Restrict external storage media
- TPC1.20 SPF, DKIM and DMARC on your mail domain
- TPC1.21 Anti-spam inspection of inbound e-mail
- TPC1.22 Signature analysis of e-mail attachments
- TPC1.23 Private e-mail domain only
- TPC1.24 Block Office macros from external files
- TPC1.25 Time synchronisation with an authorised source
- TPC1.26 Protect event logs
- TPC1.27 Firewalls enabled on all endpoints
- TPC1.28 Web Application Firewall for internet-facing apps
- TPC1.29 Up-to-date antivirus and anti-malware
- TPC1.30 Test patches before production, or be able to roll back
Detect · 1
Our support
Five steps, from classification to certificate
- 1
Classification
We help determine your likely classification and prepare the documents for confirmation with your Aramco proponent: the Third Party Classification Template and the Classification Confirmation Letter.
- 2
Gap assessment
Every applicable SACS-210 control is checked against your actual setup and the evidence you already have.
- 3
Remediation
Policies, procedures and technical measures (authentication, access management, logging, backups…): our engineers implement them, not just on paper.
- 4
Evidence pack
Completed self-assessment and evidence filed control by control, ready for the audit firm.
- 5
Audit & renewal
We support you during verification, then help you maintain compliance and prepare for renewal.
Deliverables
What you get
- Classification Template and Classification Confirmation Letter prepared for confirmation with your Aramco proponent
- Gap report, control by control, with owners and deadlines
- The policies SACS-210 requires, adapted to your company
- Technical controls configured (MFA, e-mail, endpoints, logging…)
- Self-assessment report and time-stamped evidence pack
- Renewal calendar and follow-up until the next certificate
Why Vaurely
Engineers who build the controls, not just the binder
Vaurely is not an Aramco-authorised audit firm and does not issue the certificate. We prepare your company and support you up to the assessment carried out by the authorised firm of your choice.
See all our services-
Controls that really work
Many gaps are technical. Our team configures and documents them, so your evidence reflects reality.
-
One point of contact
A single person follows your file from classification to the audit firm’s report.
-
After the certificate
The same team can take you further: NIS2, Cyber Resilience Act, GDPR, internal tools.
+Who issues the Aramco CCC?
Only audit firms authorised by Aramco, listed on Aramco’s CCC program page. You request the certificate through the CCC portal, then submit it with the compliance report through the Aramco e-Marketplace.
+How do I know whether I need the CCC or the CCC+?
It depends on your classification, which you confirm with the Aramco department that owns your contract through the Third Party Classification Template. Critical Data Processors need the CCC+. For Network Connectivity, Aramco’s public guidance is contradictory: confirm the required certificate with your Aramco proponent and your authorised audit firm. Our free classification check gives you a first answer in a minute.
+How long is the certificate valid?
Two years from issuance. You must renew it before it expires, and a new contract under a classification your certificate does not cover requires a new certificate.
+We were certified under SACS-002. What changes?
Your next assessment is made against SACS-210, the February 2026 standard. Controls are renumbered, some requirements are new (for example SPF, DKIM and DMARC, or centralised identity management) and OT is now a classification. Check your gaps well before renewal.
+We are a European company. Does this apply to us?
Yes, if you supply Aramco or another Aramco group company such as SABIC. The standard applies to all third parties, wherever they are based. We work in English and French.
+Can Vaurely issue the certificate?
No. We are not an authorised audit firm. We prepare your company and your evidence, then support you during the assessment by the authorised firm you choose.
Let’s talk about
your project.
Describe what you need in a few lines. We reply within 2 business days.
contact@vaurely.com- Free 30-minute discovery call
- Reply within 2 business days
- Fixed quote, agreed upfront
- Optional monthly maintenance plan