Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Secure return of proponent data at the end of its lifecycle or retention period.
- Deletion from all technology assets, including backups.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Keep Aramco data in identified locations so it can be exported and deleted; check backup retention of any third-party backup tool.
Google Workspace
- Keep Aramco data in an identified shared drive; check retention in Google Vault and any backup tool.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- A documented end-of-contract procedure; for completed contracts, a return and deletion record.
Common mistakesVaurely guidance
- Deleting the live data but forgetting backups and archives.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.