Aramco Cybersecurity Requirements for New Vendors
Any company that wants to work with Saudi Aramco as a third party must meet the SACS-210 standard and hold a Cybersecurity Compliance Certificate (CCC). If this is your first time, we take you from zero — even if your company has no IT setup yet.
Does SACS-210 Apply to Your Company?
According to the standard, SACS-210 applies to every third party that processes, transmits or stores Aramco information, has access to an Aramco endpoint, provides software or technical products for Aramco's use, has a connection to its network, or provides consultancy for high-sensitivity projects.
Control TPC-1.5 requires the third party to obtain a Cybersecurity Compliance Certificate (CCC) from an authorized audit firm and submit it through the established process. The General Requirements apply regardless of company size.
Most new companies are closer than they think: a company email domain, protected laptops and a few written policies cover a large part of the requirements. We set up what is missing and prove it to the auditor.
From Zero to Certified
We handle the technical side completely, in plain language.
Clear starting point
Our questionnaire shows exactly where your company stands against the 33 General Requirements — before you commit to anything.
Email and cloud setup
If you do not have a company email domain yet, we set up Microsoft 365 or Google Workspace with the required security settings.
Devices secured
We apply the controls on every computer: accounts, MFA, anti-virus, firewall, encryption, updates and logging.
Policies written for you
We prepare the cybersecurity policies and procedures the standard asks for, tailored to your company.
Evidence and audit
We capture the screenshot evidence, build the report, submit it and attend the live audit session with you.
Support after certification
Maintenance contracts keep your controls active, and we remind you before renewal in 24 months.
Your First Certificate, Step by Step
Send your request
Use the request button on this page. The SACS-210 questionnaire is emailed to you immediately.
Questionnaire & quotation
Answer what you know — "Do Not Know" is fine. We review it and send your quotation.
Setup & implementation
We set up what is missing and apply TPC-1.1 – TPC-1.33 on your devices and systems.
Evidence report
We document every control with screenshots and submit the report to the auditor.
Audit session & certificate
The auditor inspects the implementation in a live online session and issues your certificate, valid for 24 months.
Questions Clients Ask
You May Also Need
SACS-210 Certificate — Full Guide
The 33 requirements, the certification process, the audit session and validity.
Learn more →SACS-210 Certificate Renewal
We update your controls, rebuild the evidence report and attend the audit before your certificate expires.
Learn more →SACS-002 to SACS-210 Transition
SACS-002 was cancelled in February 2026. See what changed and how to move to SACS-210.
Learn more →IT Maintenance Contracts
Computers, networks, updates and user support under one contract — remote and on-site.
Learn more →Starting With Aramco? Start With the Certificate
Send your request — the questionnaire reaches your inbox immediately and we guide you from there.