Aramco CCC · Standard guide · Updated 2026-10-30
SACS-210, control by control
SACS-210 is the Saudi Aramco Third-Party Cybersecurity Standard behind the Cybersecurity Compliance Certificate (CCC). It replaced SACS-002 in February 2026. Here are the 33 general requirements every supplier must meet, explained in plain English, with our practical guidance for Microsoft 365 and Google Workspace and the evidence to prepare.
Scope
Who must comply
Section 2 of SACS-210 covers a third party in any of these situations. One is enough.
- It processes, transmits or stores company information or personal data.
- It has access to a company endpoint (computer or server).
- It supplies off-the-shelf or customised technical products (applications, software) used by the company.
- It is connected to the company network.
- It provides consultancy on high-sensitivity strategic projects at national level.
SACS-002 → SACS-210
What changed in 2026
If you were certified under SACS-002, your next renewal is assessed against the new standard.
- SACS-210 (February 2026) supersedes SACS-002. Older checklists and blog posts that cite SACS-002 control numbers no longer match.
- Controls are renumbered: TPC1.x for the 33 general requirements, TPC2.x for the 116 specific requirements.
- Controls are grouped by the NIST CSF 2.0 functions, including GOVERN and RECOVER.
- Classifications are renamed and extended: Outsourced Infrastructure becomes Outsourced & Managed Services, Customized Software becomes Software Services, and Operational Technology (OT) is a new classification.
- The scope is spelled out: the standard lists the situations in which a third party is covered (data, endpoint access, technical products, network connection, sensitive consultancy).
- OT suppliers face explicit IEC 62443 certification requirements.
General requirements · apply to every third party
The 33 general controls (TPC1.1 – TPC1.33)
Govern
Policies, people processes and the certificate itself.
- TPC1.1 Comply with Saudi cybersecurity and data privacy laws
- TPC1.2 Acceptable Use Policy (AUP)
- TPC1.3 Core cybersecurity policies and standards
- TPC1.4 Employee onboarding and offboarding process
- TPC1.5 Hold a valid CCC (or approved certificate)
- TPC1.6 Renew the CCC before it expires
- TPC1.7 Share client data only with contract personnel
Identify
Knowing which assets you have.
Protect
Identity, data, email and endpoint protection.
- TPC1.9 Centralised identity and access management
- TPC1.10 Unique credentials for every user
- TPC1.11 Password and passphrase rules
- TPC1.12 Multi-factor authentication (MFA)
- TPC1.13 Single sign-on only with MFA at first login
- TPC1.14 Annual review of accounts and access rights
- TPC1.15 Secure authentication for all technology assets
- TPC1.16 Return, then delete, client data at end of lifecycle
- TPC1.17 Secure disposal of end-of-life assets
- TPC1.18 Encryption at rest and in transit
- TPC1.19 Restrict external storage media
- TPC1.20 SPF, DKIM and DMARC on your mail domain
- TPC1.21 Anti-spam inspection of inbound e-mail
- TPC1.22 Signature analysis of e-mail attachments
- TPC1.23 Private e-mail domain only
- TPC1.24 Block Office macros from external files
- TPC1.25 Time synchronisation with an authorised source
- TPC1.26 Protect event logs
- TPC1.27 Firewalls enabled on all endpoints
- TPC1.28 Web Application Firewall for internet-facing apps
- TPC1.29 Up-to-date antivirus and anti-malware
- TPC1.30 Test patches before production, or be able to roll back
Detect
Logging security-relevant events.
Respond
Incident notification and access hand-back.
The 116 specific requirements (TPC2.x) depend on your classification and will be documented here progressively. Need them now? Ask our team.
Classifications
Which requirements apply to you
Your classification decides which specific controls you must add on top of the general ones. If several classifications apply, you must meet the controls of all of them. It is confirmed with the Aramco department that owns your contract, through the Third Party Classification Template.
Security awareness training: section 3 of SACS-210 lists user training as part of the general requirement, yet none of the 33 general controls covers it. Yearly mandatory training appears as specific control TPC2.26. Plan a yearly, documented training for all staff whatever your classification: auditors are likely to ask for it.
Find your likely classification| SACS-002 (2022) | SACS-210 (2026) |
|---|---|
| Network Connectivity | Network Connectivity |
| Outsourced Infrastructure | Outsourced & Managed Servicesrenamed |
| Critical Data Processor | Critical Data Processor |
| Customized Software | Software Servicesrenamed |
| Cloud Computing Service | Cloud Computingrenamed |
| — | Operational Technology (OT)New |
General requirements
The baseline for every third party, whatever the service. All 33 controls on this page.
Network Connectivity
Your infrastructure connects to the Aramco network (leased line, site-to-site or SSL VPN).
Outsourced & Managed Services
You provide, run or support infrastructure or managed services for the company (data centres, co-location, backup centres).
Critical Data Processor
You develop, access or process confidential data with access to the company.
Software Services
You develop or host customised software, an application, a website or a solution.
Cloud Computing
You provide IaaS, PaaS or SaaS.
Operational Technology (OT)
You design, supply, integrate, operate or maintain OT systems (DCS, SCADA, SIS, PLC, RTU, HMI) or provide their lifecycle services.
FAQ
+Who must comply with SACS-210?
Any third party that processes, transmits or stores company information or personal data, has access to a company computer or server, supplies technical products such as software, is connected to the company network, or provides consultancy on high-sensitivity national projects. In practice, Aramco asks all vendors to obtain at least the CCC for the general requirements when they register.
+Is SACS-210 the same as SACS-002?
No. SACS-210 is the February 2026 edition of the Aramco Third-Party Cybersecurity Standard and replaces SACS-002. The scope is similar, but control numbering, structure and some requirements changed.
+How many controls are in SACS-210?
33 general requirements that apply to every third party, plus 116 specific requirements that apply depending on your classification.
+Do I need the CCC or the CCC+?
It depends on your classification. The CCC is a self-assessment verified remotely by an authorised audit firm; the CCC+ is an on-site assessment. Critical Data Processors require CCC+. For Network Connectivity, confirm the required certificate with your Aramco proponent and selected authorised audit firm, as Aramco’s public guidance currently contains conflicting information.
+How long is the certificate valid?
Two years from issuance. It must be renewed before expiry, and a new contract under a classification your certificate does not cover requires a new certificate.
Get your CCC or CCC+ prepared by engineers
Classification, gap assessment, implementation of the controls and a complete evidence pack for the authorised audit firm.
Talk to our team →Official sources: SACS-210 PDF · Aramco CCC program page
Vaurely is not affiliated with, endorsed by, or acting on behalf of Saudi Aramco, SABIC, or any Authorized Audit Firm, and does not issue the CCC. Control descriptions on this site are our own summaries for guidance only. Always refer to the official SACS-210 standard.