Saudi Arabia · Regulation guide
Aramco Cybersecurity Compliance Certificate (CCC)
Issued by Saudi Aramco (Third Party Cybersecurity Standard, SACS-002)
Applies to: Suppliers, contractors and service providers that work with Saudi Aramco, particularly those that connect to its network, handle its data, host or develop systems for it, or provide cloud or outsourced services.
Aramco requires third parties to meet its Third Party Cybersecurity Standard (SACS-002). The controls that apply depend on the type of service you provide and how it touches Aramco’s systems and data. Each type is a class with its own control set.
Compliance is demonstrated through an assessment by an Aramco-approved audit firm, which leads to a Cybersecurity Compliance Certificate (CCC). The certificate is commonly needed to bid, to be awarded work or to renew a contract, so plan for it early in a tender.
General guidance, not legal advice. Always confirm scope and current requirements with the issuing authority.
Discuss Aramco CCC with us
Gap assessment, control mapping or evidence tracking.
The path
How organisations typically get there
- 01
Confirm your class
Work out which SACS-002 classes apply from the services in your contract or tender.
- 02
Gap assessment
Compare current controls, policies and evidence with the applicable SACS-002 requirements.
- 03
Remediate
Close gaps in policies, technical controls, awareness and documentation, and prepare the evidence.
- 04
Assessment
An Aramco-approved audit firm assesses your compliance.
- 05
Certificate and upkeep
Maintain controls and evidence so renewal is routine, not a new project.
How we help
- ✓Class identification from your services and contracts
- ✓SACS-002 gap assessment and remediation plan
- ✓Policies, procedures and evidence packs
- ✓Mapping to ISO/IEC 27001 and NCA ECC to reuse work
- ✓Evidence tracking in GRC software
- ✓Staff cybersecurity awareness
Related ISO standards
Aramco CCC questions
Is Aramco’s CCC the same as NCA’s CCC?+
No. Aramco’s CCC is the Cybersecurity Compliance Certificate for its third parties under SACS-002. NCA’s CCC is the Cloud Cybersecurity Controls, a national control set for cloud providers and cloud users.
Who carries out the assessment?+
An audit firm approved by Aramco. Preparation and remediation are separate from the assessment, which keeps it independent.
Does ISO 27001 replace the CCC?+
No, but an ISO 27001 programme covers much of the same ground, so evidence can often be reused for the SACS-002 assessment.
Is this legal advice?+
No. This is a general overview. Confirm scope, the current edition and your obligations with the issuing authority and your legal or compliance advisers.
Next step
Where does your programme stand?
The GRC maturity check takes three minutes and shows which areas to fix first.