Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- WAF inspection of all HTTP/HTTPS traffic to internet-facing applications.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Not M365-specific: put public apps behind a WAF (e.g. Cloudflare, Azure Front Door WAF, AWS WAF).
Google Workspace
- Not Workspace-specific: put public apps behind a WAF (e.g. Cloudflare, Google Cloud Armor, AWS WAF).
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- WAF configuration and the list of protected applications; DNS showing traffic goes through the WAF.
Common mistakesVaurely guidance
- The marketing website or a customer portal exposed directly, without WAF.
FAQVaurely guidance
+Does our brochure website need a WAF?
The control covers internet-facing applications. TODO: confirm with an audit firm whether a static site hosted by a third party is in scope for your classification.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.