Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- Proponent data is shared only with individuals who are part of the contracted work.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Keep Aramco project data in a dedicated Team/SharePoint site restricted to a project group.
- Disable or restrict anonymous and external sharing on that site.
Google Workspace
- Use a dedicated shared drive restricted to a project group; restrict external sharing for that drive or organisational unit.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- List of people assigned to the contract vs. the members of the project workspace.
- Sharing settings of the workspace (screenshot).
Common mistakesVaurely guidance
- Aramco documents stored in a company-wide share accessible to everyone.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.