Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Notification to the proponent within 24 hours of discovery.
- Follow the Appendix A process: notify the proponent SOC by its hotline, review recent account and access changes, isolate affected systems, preserve images and logs, send interim reports every 24 hours, support forensic analysis.
- Final reports: a business report within 3 business days and a technical report within 10 business days of resolution.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Not a technical setting: write the procedure, include the hotline numbers from the standard, and test it in a tabletop exercise.
Google Workspace
- Not a technical setting: write the procedure, include the hotline numbers from the standard, and test it in a tabletop exercise.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- Incident response procedure stating that the 24-hour clock starts at discovery, and covering the Appendix A steps; record of a test or a real incident.
Common mistakesVaurely guidance
- A generic incident plan with no mention of notifying Aramco or the 24-hour deadline.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.