Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Remote access, including access from the internet.
- Cloud services.
- Company e-mail accessed via web or mobile devices.
- Internet-facing applications.
- Privileged accounts.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Enable Security defaults, or (with Entra ID P1) Conditional Access policies requiring MFA for all users and all cloud apps.
- Add a dedicated policy requiring phishing-resistant MFA for admin roles.
- Block legacy authentication, which bypasses MFA.
Google Workspace
- Admin console → Security → Authentication → 2-step verification: allow, then enforce for all organisational units.
- Require security keys for Super Admins where possible.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- Screenshot of Security defaults / Conditional Access policies (or Google 2SV enforcement settings).
- MFA registration report showing all users enrolled.
- For VPN and other internet-facing apps: their MFA configuration.
Common mistakesVaurely guidance
- MFA enforced for staff but not for the admin or “break-glass” accounts, or the reverse with no documentation.
- Legacy protocols (IMAP/POP/SMTP auth) still open, letting sign-ins skip MFA.
- VPN or remote desktop exposed without MFA.
FAQVaurely guidance
+Is SMS acceptable as a second factor?
The standard requires MFA without naming methods. Authenticator apps or security keys are stronger and less likely to raise questions. TODO: confirm auditor stance on SMS.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.