SACS-210 Certification Requirements: A Complete Checklist for Your Company

When your company decides to get its SACS-210 certificate (CCC) for the first time, or to renew it, the first question is always the same: what do we need to prepare?

This is a practical checklist of everything involved: basic company information, the technical setup, the written policies and the evidence report. Use it to see where your company stands before you start.

1. Basic Information About Your Company

Before any technical work, whoever prepares your certificate needs a clear picture of the company. This is the information we ask for in our SACS-210 questionnaire:

• Your company’s main email domain, for example company.com.
• Your Aramco vendor ID if you have one, and the nature of your contract or services.
• Previous certificate: do you hold a SACS-002 certificate, and when does or did it expire?
• Number of users in the whole company, not only those on Aramco projects.
• Number of devices: laptops and desktops, plus servers if any.
• Number of locations, and whether any are outside Saudi Arabia.
• Current email provider: Microsoft 365, Google Workspace, Zoho or another.

This information defines the size and duration of the work, and the quotation is based on it.

2. The Technical Setup

These are the main technical requirements of the standard, with the related control for each:

Email

• A private company email domain; no Gmail or Hotmail for work (TPC-1.23).
• SPF, DKIM and DMARC records on the domain (TPC-1.20).
• Anti-spam inspection of incoming email and attachment scanning (TPC-1.21 and TPC-1.22).

Accounts and access

• A central user directory such as Microsoft Entra ID or Google Workspace (TPC-1.9).
• A unique account for every employee, with no shared accounts (TPC-1.10).
• A password policy: 8 to 64 characters, with upper and lower case, digits and symbols (TPC-1.11).
• Multi-factor authentication on email, cloud services, remote access and admin accounts (TPC-1.12).

Devices

• Up-to-date anti-virus with a valid licence on every device (TPC-1.29).
• Firewall enabled on every device (TPC-1.27).
• Disk encryption such as BitLocker (TPC-1.18).
• USB and external storage restricted (TPC-1.19).
• Macros in Office files from external sources blocked automatically (TPC-1.24).
• A patching process for software and operating systems (TPC-1.30), and no unsupported systems such as Windows 7.
• Time synchronized with an authorized source such as NTP (TPC-1.25).
• Event logs enabled and protected from alteration (TPC-1.26 and TPC-1.31).

Websites and internet-facing applications

• If the company runs an application or website reachable from the internet, it must be protected by a Web Application Firewall (TPC-1.28).

3. Written Policies and Procedures

The standard asks for documents that are approved and communicated to employees, not just files kept in a folder:

1. Acceptable Use Policy (TPC-1.2).
2. Asset Management Policy.
3. Access Management Policy.
4. Physical Security Policy.
5. Secure Disposal and Media Sanitization Policy.
6. Data Classification and Handling Policy.
7. Incident Management and Response Policy.
8. Vulnerability and Patch Management Policy.
9. Business Continuity and Disaster Recovery Plan.
10. Employee onboarding procedure, including background checks (TPC-1.4).
11. Employee offboarding procedure, including asset return and access removal (TPC-1.4).

Items 2 to 9 are the eight areas required by TPC-1.3.

4. Supporting Records

Besides the policies, the auditor needs records showing that the company actually applies them:

• Asset inventory: every device with its name, user and operating system (TPC-1.8).
• List of privileged (admin) accounts across all systems.
• Record of the access review, done at least once a year (TPC-1.14).
• Incident reporting procedure to notify Aramco within 24 hours (TPC-1.32).

5. The Evidence Report

Once everything above is in place, the evidence report is prepared: screenshots documenting each control from TPC-1.1 to TPC-1.33, ordered by control number. The auditor reviews the report, then checks the implementation in a live online session before issuing the certificate.

To see the mistakes that delay certificates at this stage, read why SACS-210 audits fail.

Do You Need All of This Before Contacting Us?

No. Most companies do not have all of these items at the start, and that is normal. Knowing the basic information in section 1 is enough, and we take care of the rest:

• We review your current setup through the questionnaire.
• We set up what is missing in email, devices and accounts.
• We write the policies to fit your company.
• We build the evidence report and attend the audit session with you.

If you do not know the answer to a question in the questionnaire, you can choose “I don’t know” and we complete the picture with you.

For a detailed explanation of each control, read SACS-210 controls explained.

Request the questionnaire and it arrives in your inbox right away.