Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Ongoing compliance with KSA cybersecurity and data privacy laws, regulations, decisions, frameworks and controls.
- Compliance with any other national regulation applicable to your company (for example your home country’s rules).
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Not a technical setting. Keep a register of applicable laws and map them to your policies.
Google Workspace
- Not a technical setting. Keep a register of applicable laws and map them to your policies.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- A legal and regulatory register listing the KSA texts that apply to you (e.g. the Personal Data Protection Law) and who owns each one.
- A dated review of that register (at least yearly).
- For foreign suppliers: the home-country rules in the same register (e.g. GDPR for EU companies).
Common mistakesVaurely guidance
- Writing “we comply with all applicable laws” without listing which ones.
- Forgetting KSA data protection rules when you process personal data of Aramco staff.
FAQVaurely guidance
+Does a non-Saudi supplier have to comply with Saudi laws?
The control applies to every third party. In practice you document the KSA rules relevant to the data and services you handle for Aramco, alongside your own national rules. TODO: confirm with an authorised audit firm how they assess foreign suppliers.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.