Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Length of 8 to 64 characters; long passwords or passphrases encouraged.
- Lowercase letters, uppercase letters, digits and special characters.
- Multi-factor authentication.
- No password hints.
- The standard applies these rules “where feasible”.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Entra ID cloud passwords already require at least 8 characters and complexity.
- Check that MFA is enforced (see TPC1.12) and that on-premises AD password policy, if any, matches.
- TODO: document how you handle the rule set where Entra ID’s built-in complexity differs from the standard.
Google Workspace
- Admin console → Security → Password management: set minimum length (at least 8), enforce strong passwords, apply to existing users at next sign-in.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- Screenshot of the password policy settings in each identity system.
- Your password policy document stating the same rules.
Common mistakesVaurely guidance
- Policy document says 12 characters while the system enforces 8 (or the reverse).
- Forgetting non-SSO apps or local server accounts that have their own password settings.
FAQVaurely guidance
+Do we need to force password expiry?
SACS-210 as summarised here does not list an expiry period in the general requirements. TODO: verify against the official text before review.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.