Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Encryption of data at rest.
- Encryption of data in transit.
- Advanced level of KSA NCS-1:2020, with industry-approved algorithms.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Enforce BitLocker (Windows) and FileVault (macOS) through Intune.
- Microsoft 365 encrypts data at rest and in transit by default; document it.
- TODO: list the exact NCS-1:2020 advanced-level parameters (key sizes, TLS versions) before review.
Google Workspace
- Enforce device encryption through endpoint management; Google Workspace encrypts data at rest and in transit by default; document it.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- Device compliance report showing disk encryption on all laptops.
- TLS configuration of your public websites and mail (e.g. scan report).
- Provider documentation for cloud encryption.
Common mistakesVaurely guidance
- A few unmanaged laptops without disk encryption.
- Old TLS versions still enabled on a web server.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.