Are you ready to grow up your business? Contact Us →
+966 55 981 9942
Follow Us:
SECURE LINK
GET A QUOTE
ARAMCO CCC / SACS-210

Aramco CCC &
SACS-210 Compliance

SecureLink helps third-party organizations prepare for Saudi Aramco’s cybersecurity requirements with practical SACS-210 readiness work, including gap assessments, control guidance, documentation, evidence preparation and audit support.

Home Aramco CCC / SACS-210
Aramco CCC and SACS-210 cybersecurity compliance
CCC
Assessment
SACS-210
Controls
Risk &
Readiness
IT & OT
Security
Audit
Readiness
Aramco CCC compliance readiness support
SACS-210
Readiness
Scope &
Classification
Evidence
Preparation
Audit
Support
ARAMCO CYBERSECURITY COMPLIANCE

Prepare for your Aramco CCC / CCC+ Assessment

If you are preparing for Aramco Cybersecurity Certification, the first step is to confirm your SACS-210 scope, understand the controls that apply to your classification and address any gaps before the formal assessment.

SecureLink can support the work behind that preparation: reviewing policies and procedures, assessing control gaps, mapping evidence, planning remediation and getting the assessment package into shape. This helps your team show how the controls work in the real environment, not just on paper.

The formal verification and certificate issuance are handled by an Authorized Audit Firm under the Aramco CCC program. SecureLink’s role is to help your team get ready for that review and stay organized throughout the preparation process.

TRUSTED. PREPARED. ARAMCO READY.

Aramco Cybersecurity
Compliance (CCC & CCC+)

What is the Aramco CCC program?

Aramco’s Cybersecurity Compliance Certificate (CCC) program is used to verify that third parties meet the cybersecurity requirements that apply to them under the Third-Party Cybersecurity Standard, SACS-210. The certificate and assessment route depend on the third party’s classification.

What is the difference between CCC and CCC+?

The current program separates the two routes by assessment method. CCC starts with a self-compliance assessment and remote verification by an Authorized Audit Firm, while CCC+ includes an on-site assessment. Aramco lists Network Connectivity and Critical Data Processor under CCC+, with General Requirements, Outsourced Infrastructure, Customized Software, Cloud Computing and Operational Technology under CCC.

SACS-210
Scope
Remote
Verification
On-Site
Assessment
Two-Year
Validity
Aramco CCC and SACS-210 cybersecurity requirements
Control
Readiness
Evidence
Package
Risk &
Remediation
Audit
Coordination

1. Cybersecurity Compliance Certificate (CCC)

For CCC, the Third Party completes a self-compliance assessment against the SACS-210 controls that apply to its classification, followed by remote verification by an Authorized Audit Firm.

Current CCC classifications include:
  • General Requirements
  • Outsourced Infrastructure
  • Customized Software
  • Cloud Computing
  • Operational Technology

2. Cybersecurity Compliance Certificate Plus (CCC+)

CCC+ follows an on-site assessment by an Authorized Audit Firm against the SACS-210 controls that apply to the relevant classification.

Current CCC+ classifications include:
  • Network Connectivity
  • Critical Data Processor
  • On-site verification by the Authorized Audit Firm

3. SACS-210 Third-Party Cybersecurity Standard

SACS-210 sets out the cybersecurity requirements that apply to Aramco third parties. The February 2026 edition separates General Requirements from Specific Requirements that depend on the third party’s classification.

General Requirement domains include:
  • Governance and cybersecurity policies
  • Asset management and access control
  • Data, email and platform security
  • Continuous monitoring and incident management

4. Evidence & Compliance Report Preparation

As part of the current program, the Third Party completes the Cybersecurity Compliance Report and provides the supporting evidence needed for the assessment.

Evidence should be:
  • Comprehensive and clearly described
  • Readable and appropriately time stamped
  • Clearly linked to the Third Party being assessed
  • Organized against the applicable scope controls

5. Classification & Scope Management

The Specific Requirements you need to address depend on the third-party classification. More than one classification can apply, so the assessment scope should cover the controls linked to each applicable classification.

Scope may relate to:
  • Network connectivity
  • Outsourced & managed services
  • Critical data processing
  • Software, cloud and OT services

6. Validity, Renewal & Scope Changes

Aramco states that a CCC is valid for two years from its issuance date, so renewal planning should start well before the certificate expires.

  • A new contract may require additional assessment when its classification is not covered by the current certificate
  • A contract under the same classification does not automatically require a new certificate
  • Changes in classification should trigger a scope review

Get your SACS-210 scope, controls, documentation and evidence organized before the formal CCC or CCC+ verification stage.

Request Aramco CCC Readiness Assessment →
SACS-210 REFERENCE

Understanding the Current Aramco Standard

Aramco’s current CCC program uses SACS-210 as the Third-Party Cybersecurity Standard. Use the current program guidance and applicable requirements when preparing your scope, controls and assessment evidence.

SACS-210 — Current Standard

The published SACS-210 standard defines the cybersecurity requirements that apply to Aramco third parties. The current program separates General Requirements from Specific Requirements based on the applicable third-party classification.

View SACS-210 standard →

Aramco CCC Program & Classifications

The applicable CCC or CCC+ route depends on how the Third Party is classified. Confirm the scope first, then identify the requirements that apply before preparing the compliance report and evidence.

Open Aramco CCC Program →

Scope First, Then Map the Controls

Start with the current classification and scope. Map the applicable SACS-210 General and Specific Requirements, then organize the policies, configurations, records and other evidence needed for the assessment.

Check Aramco Program Guidance →
ARAMCO CCC / SACS-210 RESOURCE

SACS-002 vs SACS-210: Practical Explainer

Encountering SACS-002 and SACS-210 references while preparing for Aramco cybersecurity compliance?

Get SecureLink’s practical explainer to review the terminology, current SACS-210 scope, CCC and CCC+ implications, and the preparation points your team should understand before the formal verification stage.

01 SACS-002 and SACS-210 terminology at a glance
02 Current SACS-210 scope and classification context
03 CCC vs CCC+ assessment implications
04 Control, evidence and documentation considerations
05 Key readiness questions to review before assessment
Reference: View Aramco’s current CCC program guidance →

Get the Explainer

Submit your business details so the SecureLink team can provide the Aramco SACS-002 vs SACS-210 resource.

PDF resource: 7-page practical explainer. Complete the required fields, then the guide opens directly in a new tab.

The button opens the PDF only and does not redirect to the Contact Us page.

OFFICIAL ARAMCO RESOURCES

Current CCC & SACS-210 Documents

Use the current Aramco materials as the authoritative reference for scope, controls, certification requirements and assessment preparation.

OFFICIAL PDF

SACS-210 Third-Party Cybersecurity Standard - February 2026

Read the current standard covering General Requirements, Specific Requirements and third-party classifications.

View SACS-210 Standard
OFFICIAL DOCX

Third Party Cybersecurity Compliance Report Template - 2026

Use Aramco's current report template when preparing the evidence and compliance package for formal verification.

Open Compliance Report Template
PROGRAM GUIDANCE

Aramco Third Party Cybersecurity Compliance Certificate Program

Check the current certification steps, Authorized Audit Firms, CCC Portal information, downloads and FAQs.

View CCC Program Guidance
SACS-210 READINESS AREAS

What Your SACS-210 Readiness Review Should Cover

A practical SACS-210 review should start with the General Requirements, then address the Specific Requirements linked to the applicable classification.

Governance & Policies

Review the policies and governance processes that support cybersecurity, including acceptable use, responsibilities, onboarding and offboarding, business continuity and related controls.

Asset Management

Keep a reliable inventory of information and technology assets, with clear ownership and defined lifecycle responsibilities.

Identity, MFA & Access

Check how access is managed across the environment, including unique accounts, password controls, MFA, privileged access and regular reviews of user rights.

Data, Email & Platform Security

Review the protections used for data, email and platforms, including encryption, secure disposal, external media, endpoint protection, patching and web application security where applicable.

Operational Technology Security

Where OT falls within scope, review the security controls around industrial systems such as DCS, SCADA, SIS, PLCs and HMIs, along with the related lifecycle and support processes.

Monitoring & Logging

Make sure audit and cybersecurity event logs are enabled, protected and available when the assessment needs to confirm what happened and when.

Incident Response & Evidence

Keep incident response procedures current and make sure the supporting evidence is readable, current and clearly tied to the Third Party being assessed, including the applicable notification process.

WHY CHOOSE US

Why Choose SecureLink for Aramco CCC & SACS-210 Readiness

We focus on the work that needs to happen before the formal assessment: understanding the scope, closing control gaps and making the evidence easy to review. SecureLink does not present itself as the certifying body.

Aramco-Focused Readiness

Our work stays focused on the current CCC program and the SACS-210 requirements that apply to the engagement. If you are looking for an Aramco CCC Consultant, SecureLink can help with scope review, gap assessment and evidence preparation.

Control-to-Evidence Mapping

We connect each applicable control to the policies, configurations, records and other evidence that support it, giving your team a clearer assessment package.

Gap Assessment & Remediation

We identify the gaps that matter most, agree practical remediation steps and help your team turn the written requirements into working controls.

Documentation That Reflects Reality

We check that policies, procedures and technical evidence match the environment you actually run, which helps avoid avoidable inconsistencies during assessment.

Audit Coordination Support

We help your team get ready for an Aramco Cybersecurity Audit by organizing the required documentation and evidence and supporting coordination around the formal verification stage.

Ongoing Scope & Renewal Review

After the first assessment, we can help review changes to the environment, classification or evidence requirements so the compliance work stays current and renewal does not become a last-minute exercise.

25+ Years of Team Experience

SecureLink was founded by a team with 25 years of experience. Consultant profiles, certifications and project credentials should be presented clearly so buyers can verify the people behind the work.

Evidence-Focused Preparation

We organize the policies, technical evidence, records and supporting documentation around the applicable SACS-210 scope so your assessment package is clearer and easier to review.

ARAMCO CCC PROCESS

How to Prepare for Aramco CCC or CCC+

Start by confirming the scope and controls, prepare the evidence, and then move into formal verification with the selected Authorized Audit Firm.

01

Confirm Scope &
Classification

Check the registration details, Third Party Classification Template and Confirmation Letter, then confirm which cybersecurity classification applies to the work.

02

Map Applicable
SACS-210 Controls

Map the applicable General Requirements first, then address the Specific Requirements linked to each classification that applies to the Third Party.

03

Select an
Authorized Audit Firm

Use the Aramco CCC Portal to select an Authorized Audit Firm and complete the required engagement before the verification stage begins.

04

Prepare Compliance
Report & Evidence

Complete the Third Party Cybersecurity Compliance Report with clear answers and supporting evidence that is readable, time stamped and directly linked to the Third Party being assessed.

05

Verification &
Certificate Issuance

For CCC, the Authorized Audit Firm carries out remote verification; CCC+ involves an on-site assessment. The Authorized Audit Firm completes the formal verification and certificate process.

06

Submit, Maintain
& Renew CCC

After issuance, submit the certificate and report through the established Aramco e-Marketplace process, keep an eye on changes in scope and plan renewal before the two-year validity period ends.

SecureLink helps organizations prepare for Aramco CCC and SACS-210 with practical control, documentation and evidence support.

Request Aramco CCC Readiness Assessment
FAQ'S

Frequently Asked Questions

Here are straightforward answers to common questions about Aramco CCC, CCC+, SACS-210 and the preparation process.

What is the Aramco Cybersecurity Compliance Certificate (CCC)?
The CCC is part of Aramco’s third-party cybersecurity compliance program and is used to confirm that applicable third parties meet the SACS-210 cybersecurity requirements that apply to them.
What is SACS-210?
SACS-210 is Aramco’s Third-Party Cybersecurity Standard. The February 2026 edition separates General Requirements from the Specific Requirements that depend on the third-party classification.
Who needs an Aramco cybersecurity certificate?
Aramco states that third parties are required to obtain cybersecurity compliance certification, with the certificate type and assessment route determined by the applicable classification.
What is the difference between CCC and CCC+?
CCC starts with a self-compliance assessment followed by remote verification by an Authorized Audit Firm. CCC+ includes an on-site assessment by an Authorized Audit Firm.
What happens if both CCC and CCC+ apply to our classification?
Aramco’s current program states that when both CCC and CCC+ apply to the classification, the CCC+ application is the one required and accepted.
Which classifications currently require CCC+?
Aramco’s current CCC program identifies Network Connectivity and Critical Data Processor as CCC+ classifications. General Requirements, Outsourced Infrastructure, Customized Software, Cloud Computing and Operational Technology are identified under CCC.
Can more than one SACS-210 classification apply to the same organization?
Yes. When more than one classification applies, the cybersecurity controls associated with each relevant classification need to be addressed.
What evidence is expected for the CCC assessment?
The current program expects clear answers supported by documentation. Evidence should be readable, time stamped and clearly connected to the Third Party being assessed.
Does SecureLink issue the official Aramco CCC?
SecureLink provides readiness, gap assessment, documentation, control guidance and audit preparation. The formal assessment and certificate issuance are handled by an Authorized Audit Firm under the Aramco CCC program.
How do I select an Authorized Audit Firm?
Aramco directs third parties to the CCC Portal to select an Authorized Audit Firm. The current authorized firm information is also published on Aramco’s CCC program resources.
How long is the CCC valid?
Aramco states that the CCC is valid for two years from the issuance date, so it should be renewed before expiry.
Does a new Aramco contract always require a new CCC?
Not automatically. A contract under the same classification does not require a new certificate, while a contract involving a classification not covered by the current certificate may require additional assessment and certificate action.
Can SecureLink help us prepare before the audit?
Yes. SecureLink can review the scope, identify readiness gaps, align policies and technical controls, organize evidence and help your team prepare for the formal verification stage.

Need help getting ready for CCC or CCC+?

Talk to SecureLink about SACS-210 readiness, evidence preparation, documentation and practical remediation support.

Request CCC Readiness Support →