Skip to content
Vaurely
Version française

Free tool · SACS-210 classification

CCC or CCC+? Find your classification

Your SACS-210 classification decides which controls you must implement and which certificate you need. Answer six questions about how you will work with Aramco to get a first answer in under a minute.

Before you start · Are you in scope?

SACS-210 applies to you if at least one of these is true:

  • It processes, transmits or stores company information or personal data.
  • It has access to a company endpoint (computer or server).
  • It supplies off-the-shelf or customised technical products (applications, software) used by the company.
  • It is connected to the company network.
  • It provides consultancy on high-sensitivity strategic projects at national level.

In practice Aramco asks every vendor for at least the CCC (general requirements) at registration.

Network Connectivity

Question 1 of 6

Will your systems connect to the Aramco network to reach its internal services?

For example a site-to-site VPN, an SSL VPN or a leased line.

→ Network Connectivity

Outsourced & Managed Services

Question 2 of 6

Will you provide, operate, maintain or support infrastructure or managed services for Aramco?

For example data centres, co-location, backup centres or managed IT services.

→ Outsourced & Managed Services · Outsourced Infrastructure in SACS-002

Critical Data Processor

Question 3 of 6

Will you develop, access or process confidential Aramco data?

Any access to data Aramco classifies as confidential, whether you store it, process it or only view it.

→ Critical Data Processor

Software Services

Question 4 of 6

Will you develop or host customised software, an application, a website or a solution for Aramco?

Custom development, integration work or hosting of a solution built for Aramco.

→ Software Services · Customized Software in SACS-002

Cloud Computing

Question 5 of 6

Will you provide a cloud service (IaaS, PaaS or SaaS) used by Aramco?

Including a standard SaaS product that Aramco staff log into.

→ Cloud Computing · Cloud Computing Service in SACS-002

Operational Technology (OT)

Question 6 of 6

Will you design, supply, integrate, operate or maintain OT products or systems?

For example DCS, SCADA, SIS, PLC, RTU or HMI, or lifecycle services such as engineering, commissioning, FAT, SAT, operations and maintenance.

→ Operational Technology (OT) · New in SACS-210

Next steps

How your classification becomes official

  1. 1

    Ask for the Classification Template

    Request the Third Party Classification Template from the Aramco department that owns your contract. Check your RFQ or contract first: its cybersecurity appendix may already state the classification.

  2. 2

    Complete it and sign the confirmation letter

    Describe your services accurately, then sign the Third Party Classification Confirmation Letter. Together they set the scope of your assessment.

  3. 3

    Pick an authorised audit firm

    Request your CCC through the CCC portal. For a CCC+, send the template and letter to the audit firm before the on-site assessment.

Source: Aramco CCC program page.

Not sure how to describe your services?

A wrong classification means auditing against the wrong controls, or the wrong certificate. We help you fill in the classification template and prepare everything that follows.

Talk to our team →
Free e-mail domain check (TPC1.20) → The 33 general SACS-210 controls →

Vaurely is not affiliated with, endorsed by, or acting on behalf of Saudi Aramco, SABIC, or any Authorized Audit Firm, and does not issue the CCC. Control descriptions on this site are our own summaries for guidance only. Always refer to the official SACS-210 standard.