SACS-210 Certificate
for Aramco Contractors
Since February 2026, Aramco's Third-Party Cybersecurity Standard SACS-210 has replaced SACS-002. We apply the requirements on your company's devices, build the screenshot evidence report, and attend the live audit session with you until your certificate is issued — in 2–4 weeks.
Aramco's Third-Party Cybersecurity Standard
SACS-210 is Saudi Aramco's Third-Party Cybersecurity Standard (February 2026 release). It applies to every third party that processes Aramco data, accesses its endpoints or network, or supplies it with technology products and services.
Control TPC-1.5 requires the third party to obtain a Cybersecurity Compliance Certificate (CCC) from an authorized audit firm, and TPC-1.6 requires renewing it before it expires. The General Requirements contain 33 controls (TPC-1.1 to TPC-1.33) that every third party must meet.
We specialise in the SACS-210 General Requirements and have delivered more than 300 certificates for Aramco contractors and vendors — from implementation on your devices to the audit session and the issued certificate.
New to working with Aramco? Requirements for new vendors →
SACS-210 General Requirements (33 Controls)
A summary of controls TPC-1.1 to TPC-1.33 as published in Aramco's standard. We implement every control and document it with screenshots in the evidence report.
Governance & Policies
Compliance with Saudi regulations, an Acceptable Use Policy, cybersecurity policies (assets, access, physical security, disposal, data classification, incidents, vulnerability & patching, business continuity), and employee onboarding/offboarding.
Supply Chain & CCC
Obtain a CCC from an authorized audit firm and submit it, renew it before it expires, and share Aramco data only with people on the contract.
Asset Management
An effective mechanism to keep an accurate inventory of all information and technology assets.
Identity & Access
Centralized identity and access management with least privilege, unique credentials, password rules, MFA for remote access, cloud, email, internet-facing apps and privileged accounts, and annual access reviews.
Data Security
Return and delete Aramco data at end of life, secure asset disposal, encryption at rest and in transit per NCS-1:2020, and restricted external storage media.
Email Security
SPF, DKIM and DMARC, anti-spam inspection of incoming mail, signature-based attachment scanning, and a private company email domain (no Gmail/Hotmail).
Endpoint & Platform Security
Block macros from external files, NTP time sync, protected event logs, firewall on every endpoint, a WAF for internet-facing apps, up-to-date anti-malware, and tested patches with back-out.
Monitoring & Incident Response
Audit logging enabled, notify Aramco within 24 hours of a cybersecurity incident, and notify it when an employee no longer needs Aramco credentials.
Note: the standard defines additional requirements (TPC-2) for specific classes such as network connectivity, managed services, critical data processing, software, cloud and operational technology. Our service covers the General Requirements TPC-1.1 – TPC-1.33.
From Questionnaire to Issued Certificate
The same steps behind 300+ certificates — usually completed in 2–4 weeks.
Questionnaire & Quotation
Implementation on Your Devices
Screenshots & Evidence Report
Live Audit Session
Certificate Issued
Holding a SACS-002 Certificate?
Move to SACS-210
Aramco retired SACS-002 in February 2026, and SACS-210 is now the standard for third parties. When your current certificate expires, you will need to certify under SACS-210.
The new standard organises the General Requirements into 33 controls (TPC-1.1 – TPC-1.33), including restricted external storage media, macro blocking, time synchronization, a web application firewall and 24-hour incident notification. We review where you stand against SACS-210 and implement what is missing.
SirajTech vs. Doing It Alone
Renewal & Ongoing Obligations
Renew Every 24 Months
TPC-1.6 requires renewing the certificate before it expires. We contact you ahead of the date and prepare the renewal evidence report.
Controls Must Stay Active
Compliance is continuous, not just during the audit. Our maintenance contracts keep devices and settings up to date all year.
Report Incidents Within 24 Hours
TPC-1.32 requires notifying Aramco within 24 hours of discovering a cybersecurity incident and following the standard's response process.
Notify Aramco When Access Ends
TPC-1.33 requires notifying Aramco when an employee holding Aramco credentials is transferred or leaves.
SACS-210 Questions Answered
Start Your SACS-210 Certificate Today
Send your request and our SACS-210 questionnaire arrives in your inbox right away — then we send your quotation.