Aramco Cybersecurity Compliance Certificate (CCC): SACS-210 for Suppliers

Who Needs CCC

Registration-phase vendors need CCC covering General Requirements. Classification (and whether CCC+ applies) depends on how the supplier connects and what data or network access is involved — confirm against Aramco’s current supplier cybersecurity portal and contract language.

How Suppliers Prepare

• Map TPC1.1–TPC1.33 to policies, technical configs, and evidence owners
• Complete self-assessment honestly before remote verification
• Prepare on-site evidence packs early if Network Connectivity or Critical Data Processor paths apply
• Align logging, IAM, and vulnerability management with both Aramco expectations and any NCA ECC obligations you already hold

Confirm process steps, portals, and validity rules on Aramco’s official CCC programme materials. This page does not invent vendor pricing or unofficial pass rates.

How CyberSilo Helps

• CSA can organise third-party control evidence that overlaps ECC Domain 4 and supplier questionnaires
• ThreatHawk supports continuous monitoring evidence often requested in supplier assurance
• Scoping workshops for teams serving energy majors in KSA

Related Resources

ECC vs ISO 27001 · ThreatHawk · Energy & utilities

Frequently Asked Questions

What is Aramco CCC based on today?

The current Aramco Cybersecurity Compliance Certificate programme is based on SACS-210 Third Party Cybersecurity Standard. Legacy SACS-002 certificates may remain valid until expiry during transition.

What is the difference between CCC and CCC+?

CCC is remote verification after self-assessment. CCC+ adds on-site assessment for classifications such as Network Connectivity and Critical Data Processor.

How many General Requirements controls are there?

General Requirements include 33 controls numbered TPC1.1 through TPC1.33. Registration-phase vendors typically need CCC — General Requirements. Certificates are typically valid for about two years.