Prepare for your SACS-002 Aramco CCC audit with less manual work

SACS-002 is Saudi Aramco's Third Party Cybersecurity Standard, issued by Aramco's Information Security Department. It sets 92 cybersecurity controls, numbered TPC-1 to TPC-92, that third parties must meet when they provide goods or services to Aramco. Some controls apply to every supplier, such as multi-factor authentication, patching and security awareness training, while others apply only to suppliers with network connectivity, critical data or cloud services.

Suppliers, contractors and service providers that work with Saudi Aramco must comply with SACS-002 as a condition of doing business. Every third party must meet the general requirements, TPC-1 to TPC-23. Third parties are then classified by the services they provide, for example connecting to Aramco's network, processing Aramco critical data or providing cloud computing services, and must also meet the specific requirements linked to their classification.

The Cybersecurity Compliance Certificate (CCC) is how a third party proves it meets SACS-002. Under the standard, a third party must obtain a CCC from a Saudi Aramco authorised audit firm, in line with its classification, and submit it to Aramco through the Saudi Aramco e-Marketplace system. The certificate must be renewed every two years, so controls need to stay in place between assessments.

SACS-002 is a contractual requirement rather than a law, so the consequence of non-compliance is commercial. A supplier that cannot obtain or renew its Cybersecurity Compliance Certificate may be unable to bid for or continue work with Saudi Aramco. The standard also places ongoing duties on suppliers, such as notifying Aramco within 24 hours of discovering a cybersecurity incident.

Start by confirming your third party classification, then compare your controls against the general requirements and the specific requirements that apply to you. Typical gaps include multi-factor authentication, SPF on email, monthly vulnerability scanning, annual penetration testing, one-year log retention and documented incident, backup and continuity plans. Collect evidence for each TPC control, fix gaps, then book your assessment with an Aramco authorised audit firm.

SACS-002 and ISO 27001 overlap heavily, covering access control, cryptography, incident management, business continuity and supplier security, so an ISO 27001 information security management system gives a strong head start. However, ISO 27001 certification does not replace the Aramco CCC. SACS-002 adds specific technical rules, such as SPF on Aramco email domains, AES-256 encryption and fixed vulnerability remediation timeframes, that must be evidenced separately.

SACS-002 was issued in February 2022 and has been the standard behind Aramco's CCC programme. Aramco's supplier site now also lists a newer Third Party Cybersecurity Standard, SACS-210, so suppliers should check which edition their contract, classification and assessment refer to. Many of the core controls, such as multi-factor authentication and incident notification, are likely to remain relevant whichever edition applies.

Yes, SACS-002 is mapped in OneClickComply's control library and is available on request. Its 92 TPC controls are mapped to the same controls used for frameworks such as ISO 27001 and SOC 2, so evidence collected once counts towards each. OneClickComply helps you prepare and monitor your controls, but the CCC itself is issued through Aramco's authorised audit firms.