SACS-210 Controls Explained: The Complete Guide to Aramco CCC Certification (2026)

The Cybersecurity Compliance Certificate (CCC) is a basic requirement for any company that works with Saudi Aramco as a third party. Since February 2026, the certificate is issued under SACS-210, Aramco’s Third-Party Cybersecurity Standard, which replaced SACS-002.

This guide explains, in plain language, the General Requirements of the standard: 33 controls numbered TPC-1.1 to TPC-1.33. They apply to every third party, whatever its size or the services it provides. For each control we explain what it means in practice inside your company.

Note: this is a simplified explanation for awareness. The official reference is the text of the SACS-210 standard published by Saudi Aramco.

How SACS-210 Is Structured

The standard groups the General Requirements into five functions:

• Govern: TPC-1.1 to TPC-1.7.
• Identify: TPC-1.8.
• Protect: TPC-1.9 to TPC-1.30.
• Detect: TPC-1.31.
• Respond: TPC-1.32 and TPC-1.33.

On top of the General Requirements, there are Specific Requirements for third parties that fall under certain classes, such as companies connected to Aramco’s network, companies managing services owned by Aramco, critical data processors, and operational technology providers. This guide covers the General Requirements only.

1. Govern (TPC-1.1 to TPC-1.7)

TPC-1.1 Regulatory compliance

Continuous compliance with all cybersecurity and data privacy laws and regulations in Saudi Arabia.

TPC-1.2 Acceptable Use Policy

An Acceptable Use Policy (AUP) that is approved and communicated to employees. It tells staff what is and is not allowed when using company devices, email and systems.

TPC-1.3 Cybersecurity policies and standards

Written, approved policies covering at least eight areas:

1. Asset management.
2. Access management.
3. Physical security.
4. Secure disposal of media and sanitization of data.
5. Classification and handling of assets and data.
6. Incident management.
7. Vulnerability and patch management.
8. Business continuity and disaster recovery.

TPC-1.4 Onboarding and offboarding

A documented onboarding process that includes background checks, and a documented offboarding process that includes returning assets and removing access rights.

TPC-1.5 Obtain the CCC

Obtain the Cybersecurity Compliance Certificate from an authorized audit firm and submit it to Aramco through the established process.

TPC-1.6 Renew before expiry

Renew the certificate before it expires. The CCC is valid for 24 months, so we recommend starting your SACS-210 renewal about two months before the expiry date.

TPC-1.7 Need-to-know data sharing

Aramco data is shared only with the people who actually work on the contracted scope.

2. Identify (TPC-1.8)

TPC-1.8 Asset inventory

An effective mechanism to keep an accurate, up-to-date inventory of all information and technology assets: computers, servers, network devices and systems.

3. Protect (TPC-1.9 to TPC-1.30)

This is the largest part of the standard and holds most of the technical controls.

Identity and access (TPC-1.9 to TPC-1.15)

• TPC-1.9 Centralized identity management: user accounts and permissions managed from one central system, such as Microsoft Entra ID or Google Workspace, based on need-to-know, least privilege and segregation of duties.
• TPC-1.10 Unique accounts: no shared accounts between employees.
• TPC-1.11 Passwords: 8 to 64 characters, combining lower case, upper case, digits and special characters, with multi-factor authentication and no password hints.
• TPC-1.12 Multi-factor authentication (MFA): mandatory on remote access, cloud services, company email on web and mobile, internet-facing applications and privileged accounts.
• TPC-1.13 Single sign-on (SSO): allowed, but must be coupled with MFA at initial login.
• TPC-1.14 Access reviews: user accounts and access rights reviewed at least once a year.
• TPC-1.15 Device authentication: all technology assets authenticated with secure mechanisms.

Data and email security (TPC-1.16 to TPC-1.26)

• TPC-1.16 Return and delete Aramco data: at the end of the data life cycle or retention period, the data is returned to Aramco and then deleted from all assets, including backups.
• TPC-1.17 Secure disposal of assets: at end of life, or when assets are loaned, donated or transferred.
• TPC-1.18 Encryption: data encrypted at rest and in transit, in line with the advanced level of the Saudi National Cryptographic Standards (NCS-1:2020). In practice: disk encryption such as BitLocker, and encrypted connections.
• TPC-1.19 External storage media: USB drives and external disks restricted and secured.
• TPC-1.20 Email domain protection: SPF, DKIM and DMARC configured.
• TPC-1.21 Anti-spam: all incoming internet email inspected.
• TPC-1.22 Attachment scanning: email attachments inspected before they reach the user.
• TPC-1.23 Private email domain: Gmail, Hotmail or any public domain must not be used for work.
• TPC-1.24 Block macros: Microsoft Office macros in files from the internet or email attachments blocked automatically.
• TPC-1.25 Time synchronization: all assets synchronized with an authorized time source such as an NTP server.
• TPC-1.26 Log protection: event logs protected from alteration, deletion and unauthorized access.

Platform security (TPC-1.27 to TPC-1.30)

• TPC-1.27 Endpoint firewall: enabled on every device.
• TPC-1.28 Web Application Firewall (WAF): inspecting HTTP and HTTPS traffic to internet-facing applications.
• TPC-1.29 Anti-malware: signature-based, up-to-date virus and malware protection on all assets.
• TPC-1.30 Patch testing: security patches tested before production, or a back-out option in place.

4. Detect (TPC-1.31)

TPC-1.31 Audit logs

Audit and cybersecurity event logs enabled on systems and applications. Appendix C of the standard lists the events to capture, including:

• Failed login attempts.
• Creation and deletion of user accounts.
• Changes to privileges and security settings.
• Activities of privileged accounts.
• Logs being cleared or paused.

5. Respond (TPC-1.32 and TPC-1.33)

TPC-1.32 Incident notification

When a cybersecurity incident is discovered, Aramco must be notified within 24 hours, and the incident response process in Appendix A of the standard must be followed.

TPC-1.33 Notify when access is no longer needed

Aramco must be notified when an employee holding Aramco credentials no longer needs them, whether because of a transfer, a new role, retirement or leaving the company.

What This Means for Your Company

For most small and mid-sized companies, four things cover the larger part of the controls:

1. A company email domain on Microsoft 365 or Google Workspace, with SPF, DKIM, DMARC and MFA.
2. Protected devices: up-to-date anti-virus, firewall on, disk encryption, updates, USB restrictions and macro blocking.
3. Central user management with a unique account for every employee.
4. Written policies and procedures covering TPC-1.2, TPC-1.3 and TPC-1.4.

Then comes the evidence report: screenshots documenting each control. The auditor reviews the report, then checks the implementation in a live online session before issuing the certificate.

How SirajTech Helps

SirajTech’s team has delivered more than 300 certificates for Aramco contractors and suppliers. We review your company against TPC-1.1 to TPC-1.33, implement what is missing on your devices and systems, prepare the policies and the evidence report, and attend the audit session with you.

• First certificate: Cybersecurity requirements for new Aramco vendors.
• Holding a SACS-002 certificate: Moving from SACS-002 to SACS-210.
• Full certificate guide: SACS-210 certificate.

Request your certificate and the SACS-210 questionnaire arrives in your inbox right away.