Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Testing of security patches before production deployment, or measures enabling rollback or recovery.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Use Windows Update for Business rings (pilot ring first, broad ring after a few days); keep backups or snapshots for servers.
Google Workspace
- Stage OS and app updates to a pilot group first; keep backups or snapshots for servers.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- Update ring configuration or patch procedure; record of a recent patch cycle.
Common mistakesVaurely guidance
- No defined process: patches applied ad hoc, or not at all.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.