Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Automatic blocking of Office macros in files from external sources.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Intune settings catalog or Group Policy: “Block macros from running in Office files from the Internet” for Word, Excel, PowerPoint, Access and Visio.
Google Workspace
- If staff use desktop Office on managed Windows/macOS devices, apply the same Office policy through your device management.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- Screenshot of the policy and its assignment to all devices.
Common mistakesVaurely guidance
- Relying on Office defaults without a policy you can show to the auditor.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.