Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Documented onboarding, including background checks.
- Documented offboarding, including return of company assets and removal of access.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Use Entra ID lifecycle workflows (or a checklist) to disable accounts on the leaving date.
- Track device return against the Intune device inventory.
Google Workspace
- Suspend the user in the Admin console on the leaving date, transfer Drive data, and wipe/recover managed devices.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- The written joiner/leaver procedure.
- For a sample of recent joiners: background check records (or a statement that checks were done).
- For a sample of recent leavers: account disabled date vs. leaving date, asset return form.
Common mistakesVaurely guidance
- Accounts of former employees still active weeks after they left.
- No record of background checks at all.
FAQVaurely guidance
+What counts as a background check?
The standard does not define the depth. Typical evidence: identity and right-to-work check, previous employment or reference check, and criminal record check where legally allowed in your country. TODO: confirm auditor expectations.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.