Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- An effective inventory of all information and technology assets, accurate and covering all technical assets.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Export the Intune (or Defender) device inventory for laptops and phones.
- Complete it with servers, network equipment, SaaS applications and where Aramco data lives.
Google Workspace
- Export the device list from Google endpoint management; complete it with servers, network equipment and SaaS apps.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- The inventory itself (owner, type, location, status for each asset), with a recent update date.
- Consistency checks: the auditor may compare a sample of devices against it.
Common mistakesVaurely guidance
- Only listing laptops and forgetting SaaS applications, servers or network devices.
- An inventory last updated a year ago.
FAQVaurely guidance
+Is a spreadsheet acceptable?
The standard does not require a specific tool. What matters is that the inventory is complete and kept up to date; an export from your device management tool plus a maintained sheet is common for small companies.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.