Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- SSO combined with MFA at the initial login.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Apps federated with Entra ID inherit Conditional Access; make sure the MFA policy targets “All cloud apps”.
Google Workspace
- Apps using Google as SAML IdP inherit 2-step verification at Google sign-in.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- List of SSO-connected apps and the policy that enforces MFA on the identity provider.
Common mistakesVaurely guidance
- Apps that offer both SSO and a local password login, where the local login has no MFA.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.