Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- A documented Acceptable Use Policy.
- Formal approval by management.
- Communication to the people it applies to.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Publish the AUP on SharePoint/Teams and collect acknowledgements (e.g. Microsoft Forms, or Entra ID Terms of use for sign-in acceptance).
Google Workspace
- Publish the AUP on Google Sites/Drive and collect acknowledgements with Google Forms.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- The signed or approved AUP, with version and approval date.
- Proof of communication: acknowledgement records, onboarding checklist or e-mail announcement.
Common mistakesVaurely guidance
- An AUP that exists but was never approved (no signature, no date).
- No proof that employees received or accepted it.
FAQVaurely guidance
+What should an AUP cover?
Typical topics: use of company devices and accounts, e-mail and internet, passwords, personal devices, removable media, handling of client data and reporting of incidents. Align it with the other SACS-210 controls so it does not contradict them.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.