Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Events: start/shutdown/restart; successful logins from distant locations in a short time; failed logins; account creation and deletion; privilege changes; security configuration or policy changes; privileged account activity; logs cleared or paused.
- Attributes for each event: timestamp, user ID, event name, category, severity, host name, source and destination IP, source and destination port.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Make sure Microsoft Purview unified audit logging is on; use Entra ID sign-in and audit logs.
- Enable Windows security auditing on endpoints and servers (via Intune or GPO).
Google Workspace
- Use Admin console audit and investigation logs (login, admin, Drive); enable OS-level logging on servers.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- Screenshots showing logging enabled; sample log entries covering each event type in Appendix C.
Common mistakesVaurely guidance
- Cloud logs enabled but nothing on servers or network devices.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.