Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Asset management.
- Access management.
- Physical security.
- Secure disposal and data sanitisation.
- Data classification and handling.
- Incident management.
- Vulnerability and patch management.
- Business continuity and disaster recovery.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Store policies in a controlled SharePoint library with versioning; communicate them via Teams/e-mail and track acknowledgement.
Google Workspace
- Store policies in a shared drive with restricted edit rights and version history; communicate and track acknowledgement with Forms.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- Each of the eight policies (or one document with eight clearly separated sections), approved and dated.
- A review cycle (e.g. yearly) and proof the last review happened.
- Proof of communication to staff.
Common mistakesVaurely guidance
- Generic templates that describe tools or processes you do not actually have.
- Missing one of the eight topics, most often secure disposal or business continuity.
- Policies that contradict what the auditor sees in your systems.
FAQVaurely guidance
+Can we use one combined information security policy?
Usually yes, as long as each of the eight topics is clearly covered and easy for the auditor to find. TODO: confirm audit firm preference.
+Is security awareness training part of the general requirements?
Section 3 of SACS-210 says the general requirement covers user training, but none of the 33 general controls is a training control; yearly mandatory training is specific control TPC2.26. Plan and document a yearly training for all staff anyway, and reference it in your policies.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.