A SACS-210 certificate (CCC) is issued after two stages: the auditor first reviews your evidence report, then checks the implementation personally in a live online session. At either stage the auditor can raise findings that delay the certificate or require a repeat audit.
Across the more than 300 certificates SirajTech’s team has delivered, the same reasons come up again and again. Here are the ten most common, the control each one relates to, and how to avoid it before the audit.
1. A Public Email Address or an Unprotected Domain
The standard requires a private company email domain (TPC-1.23); Gmail or Hotmail must not be used for work. The domain also needs SPF, DKIM and DMARC (TPC-1.20).
The usual mistake: the company owns a domain, but there is no DMARC record or DKIM is not enabled, or some employees still send work email from personal accounts.
How to avoid it: check the domain records before the audit with a tool such as MXToolbox, and make sure every employee uses company email only.
2. MFA Enabled on Some Accounts Only
TPC-1.12 requires MFA on web and mobile email, cloud services, remote access and privileged accounts. The auditor may ask to see the setting at organization level, not just on your own account.
The accounts usually forgotten are the main admin account, an old unused account, or an account created for a new employee after MFA was rolled out.
How to avoid it: enforce MFA with an organization-wide policy, such as Security Defaults or Conditional Access in Microsoft 365, instead of enabling it account by account.
3. Shared Accounts or Accounts of Former Employees
The standard requires a unique account per user (TPC-1.10), a documented process to remove access when someone leaves (TPC-1.4), and an access review at least once a year (TPC-1.14).
An info@ account used by several people with one password, or an active account for an employee who left months ago, is one of the most common findings.
How to avoid it: review the user list before the audit, disable leavers’ accounts, and turn shared accounts into shared mailboxes that each employee opens with their own account.
4. One Non-Compliant Device
Most devices can be fine and one is still enough for a finding: an anti-virus licence that expired (TPC-1.29), a firewall switched off (TPC-1.27), or a new laptop added after the others were configured.
How to avoid it: work from your asset inventory (TPC-1.8) and check every device on it, not a sample. Ideally, manage devices from a central console such as Microsoft Intune or ManageEngine Endpoint Central so settings apply to all of them automatically.
5. Unencrypted Disks
TPC-1.18 requires data to be encrypted at rest and in transit. Windows Home editions do not fully support BitLocker, which surprises many companies at audit time.
How to avoid it: make sure devices run Windows Pro or higher, BitLocker is on for every device, and recovery keys are stored safely.
6. USB Drives and Macros Not Restricted
Two controls that are often forgotten: restricting external storage media (TPC-1.19) and automatically blocking macros in Office files from the internet or email (TPC-1.24).
How to avoid it: apply both through a central policy (Group Policy or Intune) so every device is covered, and document the setting in the evidence report.
7. Copied or Incomplete Policies
The standard asks for an Acceptable Use Policy (TPC-1.2), policies covering eight specific areas (TPC-1.3), and onboarding and offboarding procedures (TPC-1.4).
The problem is rarely missing policies. It is policies copied from the internet that still carry another company’s name, describe systems the company does not use, or skip one of the eight areas such as business continuity or secure disposal.
How to avoid it: write policies that match how your company really works, approve them formally, and distribute them to employees with a record.
8. An Asset Inventory That Does Not Match Reality
The device list given to the auditor (TPC-1.8) must match the real devices. A laptop that appears in the live session but not on the list, or the other way round, raises questions about the accuracy of the whole report.
How to avoid it: update the inventory right before the audit, with each device’s name, user and operating system.
9. Unclear or Outdated Evidence
The evidence report is the first thing the auditor sees. A cropped screenshot that does not show the full setting, one without the device name, or one reused from the previous certificate at renewal, all lead to requests for more evidence and a later certificate.
How to avoid it: take fresh screenshots for every control, showing the full setting and the device or account name, and order them by control number.
10. Not Ready for the Live Session
In the online session the auditor may ask you to share your screen and show specific settings on devices and accounts directly. If the person attending does not know where a setting is, or a setting changed after the report was prepared, the session turns into findings.
How to avoid it: run an internal mock audit before the session, have someone who knows the systems well attend, and change nothing between the report and the session.
The Takeaway
Most failures are not about a major security weakness. They come from small details: a forgotten account, one device, an unclear screenshot. The companies that pass first time are the ones that review themselves honestly before the auditor does.
For what each control requires in detail, read SACS-210 controls explained.
How SirajTech Helps
We prepare your company for the audit end to end: we check TPC-1.1 to TPC-1.33 on every device and account, fix what is missing, build the evidence report and attend the live session with you. That is why our clients’ first-time pass rate is 98%.
- First certificate: Cybersecurity requirements for new Aramco vendors.
- Renewal: SACS-210 certificate renewal.
Request your certificate and the SACS-210 questionnaire arrives in your inbox right away.
