Sections marked From the standard summarise SACS-210. Sections marked Vaurely guidance are our own practical advice, not Aramco or audit firm requirements: your authorised audit firm may assess things differently.
What the control requiresFrom the standard
- A centralised corporate identity and access management solution.
- Access based on identity, need-to-know and need-to-use.
- Least privilege and segregation of duties.
Paraphrased by Vaurely. Read the exact wording in the official standard.
How to implement itVaurely guidance
Menu names and licence requirements change over time: check the current Microsoft or Google documentation.
Microsoft 365 · Entra ID · Intune
- Use Entra ID as the single identity source; connect business apps to it with SSO.
- Use groups for access, limit Global Administrator to a few named accounts.
Google Workspace
- Use Google Workspace / Cloud Identity as the identity source and connect apps via SAML SSO.
- Limit Super Admin roles; use custom admin roles for day-to-day tasks.
Evidence to prepareVaurely guidance
Aramco’s CCC program requires recent, time-stamped and clearly labelled evidence for each control. The list below is what we recommend preparing; the audit firm decides what it accepts.
- Screenshot or export of the identity platform and the apps connected to it.
- List of administrator role holders.
- Description of how access is requested and approved.
Common mistakesVaurely guidance
- Local accounts on every app with no central control.
- Many users with admin rights “to make things easier”.
Preparing your Aramco CCC or CCC+?
Our engineers implement the controls and assemble the evidence pack with you, control by control.