Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Renewal of the CCC (or approved certificate) before its expiry date.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Add the expiry date to a shared calendar with reminders 6 and 3 months ahead.
Google Workspace
- Add the expiry date to a shared calendar with reminders 6 and 3 months ahead.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- The current certificate and its expiry date; for renewals, the new certificate issued before the old one expired.
Common mistakesVaurely guidance
- Starting the renewal too late: renewal is a full re-assessment, not a formality.
FAQVaurely guidance
+How early should we start the renewal?
The standard sets no lead time. Starting 4–6 months before expiry leaves room to close gaps found during re-assessment.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.