Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Anti-spam inspection of all inbound internet e-mail.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Exchange Online Protection does this by default; review anti-spam policies in the Defender portal and screenshot them.
Google Workspace
- Gmail filters spam by default; review Admin console → Apps → Gmail → Spam, phishing and malware settings.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- Screenshot of the anti-spam policy; if mail passes through another gateway, its configuration too.
Common mistakesVaurely guidance
- A third-party gateway or MX record that bypasses the built-in filtering.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.