Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Protection of event logs from alteration, disclosure, destruction, unauthorised access and unauthorised release.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Restrict audit log access to named roles in Purview; export logs to storage with immutability if you keep them longer than the default retention.
Google Workspace
- Restrict access to audit and investigation tools via admin roles; export logs (e.g. to BigQuery) if you need longer retention.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- List of who can read or delete logs; retention and immutability settings.
Common mistakesVaurely guidance
- Every IT admin can delete logs; no record of who accessed them.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.