Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- A CCC (or approved certificate) issued by an authorised audit firm.
- Submission to the proponent through the established process (the Aramco e-Marketplace for Aramco).
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Not a technical setting.
Google Workspace
- Not a technical setting.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- The issued certificate and the compliance report from the audit firm.
- Proof of submission through the e-Marketplace.
Common mistakesVaurely guidance
- Holding a certificate for one classification while a new contract requires another one.
FAQVaurely guidance
+Which audit firms can issue the CCC?
Only the firms listed on Aramco’s CCC program page. The list changes: always check the official page before choosing one.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.