Aramco CCC Certification – Implementation & Readiness
SACS-210 policies, controls and evidence to get your Aramco CCC fast.
- Covers
- SACS-210 (formerly SACS-002)CCC & CCC+Policies written for youControls implementedEvidence packRenewal support
- How we work
- Free readiness call → Gap assessment → Implement → Evidence pack → Assessment → Certificate & renewal
No valid CCC, and the opportunity goes to a competitor who has one. Our fix: A fast-track plan focused on what your classification actually requires.
See the common problemsRegistration or contract award waits while the certificate is missing or expired. Our fix: We work in parallel — policies, controls and evidence at the same time.
See the common problemsMFA scopes, email authentication, logging, asset inventory — what does the auditor really expect? Our fix: Plain-language guidance and controls implemented by our engineers.
See the common problemsAnswer 12 quick yes/no questions based on the general requirements every Aramco supplier must meet. Get an instant readiness score and your top gaps.
Try the CCC readiness checkAnswer a few quick questions and a Skylius specialist will prepare practical recommendations.
Request a consultationAramco CCC certification, implemented for you.
We build the cybersecurity policies, procedures and technical controls your company needs under Aramco’s Third Party Cybersecurity Standard, prepare the evidence pack, and guide you through the assessment with an Aramco-authorized audit firm — so you can secure your Cybersecurity Compliance Certificate in a short time.
Take the 2-minute CCC readiness check →
Who needs it
Working with Aramco? You need a CCC.
Aramco requires all of its Third Parties to obtain the Cybersecurity Compliance Certificate. Your classification decides which controls apply and whether a remote or on-site assessment is needed.
Suppliers & vendors
Registering with Aramco through the Supplier Registration Portal, or bidding on a new contract.
CCC requiredContractors & service providers
On-site and outsourced service companies working on Aramco Group contracts.
CCC requiredCompanies handling Aramco data
Anyone who accesses, stores or processes Aramco information — including confidential data.
Critical Data Processor: CCC+Network, software, cloud & OT providers
Companies connecting to Aramco’s network, or supplying customised software, cloud or operational technology services.
Classification-specific controlsSound familiar?
Why suppliers get stuck.
Lost or blocked tenders
No valid CCC, and the opportunity goes to a competitor who has one.
Vendor registration on hold
Registration or contract award waits while the certificate is missing or expired.
Controls that are hard to interpret
MFA scopes, email authentication, logging, asset inventory — what does the auditor really expect?
No in-house security team
IT is one busy person, or outsourced, and nobody owns cybersecurity.
The CCC in brief
Know the rules before you start.
The standard
Third Party Cybersecurity Standard (SACS-210)Aramco’s current standard for suppliers. Older documents refer to SACS-002.
Who issues it
An Aramco-authorized audit firmYou choose any firm on Aramco’s authorized list. The firm assesses you and issues the certificate.
Validity
Two yearsRenew before it expires. A new contract with a new classification needs an additional assessment.
Where it goes
Submitted through Aramco e-MarketplaceThe certificate and compliance report are submitted to Aramco after issuance.
CCC or CCC+?
| CCC | CCC+ | |
|---|---|---|
| Assessment | Your self-assessment, verified remotely by the audit firm | On-site assessment by the audit firm |
| Typical classifications | General Requirements, Outsourced Infrastructure, Customized Software, Cloud Computing, Operational Technology | Critical Data Processor (and, per Aramco’s FAQ, Network Connectivity) |
| Evidence | Recent, clear, time-stamped evidence in the compliance report | Controls verified on site, plus documentation |
Our role, clearly: Skylius is an implementation partner, not an audit firm. We prepare your company and coordinate with the authorized audit firm you choose; the assessment and certification decision remain with that firm.
What we do
From gap to certificate, we do the work.
Six workstreams, one accountable team. You make the decisions; we build, implement and document.
Gap assessment
We confirm your classification and review every applicable SACS-210 control against what you have today.
- Classification and applicability review
- Control-by-control gap register with owners
- Prioritised plan: critical gaps first
Start free: the first readiness assessment call costs nothing and tells you where you stand.
Policies & procedures
We write the documents for you — tailored to your company, not generic templates — and help you roll them out to staff.
Approved, communicated, reviewed.
Including Aramco data handling rules.
Background checks, asset return, access removal.
Least privilege, MFA, strong passphrases.
Who reports what, and how fast.
Inventory, media, secure deletion.
Technical controls
Our engineers implement the controls themselves — configured, tested and documented so they stand up in the assessment.
Evidence pack
We collect and organise the proof auditors ask for: recent, clear, time-stamped evidence clearly linked to your company.
- Evidence mapped to each applicable control
- Screenshots highlighted to show they belong to your company
- Compliance report fields completed clearly and fully
- Internal pre-check before anything is submitted
Audit support
We help you register on the CCC Portal, prepare the classification documents, and coordinate with your chosen authorized audit firm until the certificate is issued.
- CCC Portal and request preparation
- Classification template and confirmation letter support
- Answering auditor queries and closing observations quickly
- On-site preparation for CCC+ assessments
Maintenance & renewal
The certificate is valid for two years. We keep your controls running and your evidence current so renewal is routine, not a scramble.
- Ongoing patching, monitoring and access reviews
- Renewal calendar and early reminder
- Support when a new contract adds a classification
Bundle it: pair compliance with an IT maintenance contract so controls never drift.
How it works
A clear path, fast-tracked.
Free readiness call
We learn how you work with Aramco and what is already in place.
Gap assessment
Every applicable control reviewed against your current setup.
Implement
Policies written, technical controls configured and tested.
Evidence pack
Time-stamped evidence collected and mapped to each control.
Assessment
Audit firm verifies remotely (CCC) or on site (CCC+). We support you.
Certificate & renewal
Submit via e-Marketplace, then keep controls running for renewal.
Fast-trackTimelines depend on your classification, how many gaps we find and the audit firm’s schedule. We run workstreams in parallel so you are ready in a short time.
Deliverables
What you receive.
Which SACS-210 controls apply to you, and why.
Current status, gaps and owner for each control.
Written for your company, ready to approve.
MFA, endpoint, email, firewall, logging, patching.
A maintained register of your technology assets.
Time-stamped proof mapped to every control.
Clear, complete answers for the audit firm.
Short, practical training for your team.
Reminders and upkeep for your two-year cycle.
Interactive · CCC readiness check
How close are you to your CCC?
Answer 12 quick yes/no questions based on the general requirements every Aramco supplier must meet. Get an instant readiness score and your top gaps.
Do you have an approved cybersecurity policy that staff have acknowledged?Governance
Is there a formal onboarding and offboarding process (background checks, asset return, access removal)?People
Do you keep an up-to-date inventory of all IT assets?Assets
Does every user have a unique account, managed centrally with least privilege?Access
Is MFA enforced on remote access, cloud services, webmail and privileged accounts?Access
Do you use strong password rules (long passphrases, no shared passwords)?Access
Is company email on your own domain with SPF, DKIM, DMARC and anti-spam?Email
Is antivirus / endpoint protection installed and up to date on every device?Platform
Are operating systems and software patched regularly with tested updates?Platform
Are firewalls in place on your network and devices, with a web application firewall for public apps?Platform
Are security events logged, time-synchronised and protected from tampering?Detect
Could you report a cybersecurity incident to Aramco within 24 hours, with a named owner?Respond
Indicative only. Your exact scope depends on your classification, which may add specific controls (for example for network connectivity, software, cloud or OT services).
Your readiness score
Answer the questions to see where you stand.
Not started
Close these first
- Answer the questions to see your priorities.
Why Skylius
Experience that gets you certified faster.
For more than 16 years, Skylius has delivered IT, network and security projects for companies across Saudi Arabia — over 2,500 projects for more than 2,000 clients.
Our own engineers configure the firewalls, endpoint protection, MFA, backup and patching the standard calls for.
No hand-offs between consultants, IT vendors and integrators — one accountable partner.
Policies and procedures tailored to how your company really works, in clear language.
Based in Al Khobar and working on site across the Eastern Province and the Kingdom.
Maintenance and renewal support so you stay compliant for the next contract.
FAQ
Questions suppliers ask us.
Have a different question about the Aramco CCC? A specialist will reply on WhatsApp.
We start with a free readiness assessment, focus only on the controls your classification requires, and run policies, technical work and evidence collection in parallel. Most of the timeline depends on how many gaps you have and the audit firm’s schedule — we fast-track everything that is in our hands.
Yes. Most suppliers we help don’t have one. Our engineers implement the controls, we write the policies, and we prepare the evidence — your team only needs to approve decisions and follow the new procedures.
No, and we say so clearly. The certificate is issued by one of the audit firms authorized by Aramco, and you can choose any of them. Skylius is the implementation partner that gets you ready and supports you through that assessment.
For a CCC, you complete a self-assessment against the applicable SACS-210 controls and the audit firm verifies it remotely. A CCC+ requires an on-site assessment by the audit firm and applies to higher-risk classifications such as Critical Data Processor. We prepare you for either.
Aramco’s CCC programme now references the Third Party Cybersecurity Standard SACS-210; SACS-002 appears in older documents. If you already have controls in place from earlier work, we review them against the current standard and only fill the gaps.
Aramco states that the CCC is accepted by Aramco, SABIC and other Aramco Group companies, and SABIC’s supplier portal confirms its former CyberTrust programme has moved into the same CCC programme. If a contract adds a classification your certificate doesn’t cover, an additional assessment is needed.
Not necessarily. We start with what you already have; many gaps close with configuration, policies and evidence. Where a tool is genuinely missing, we recommend a right-sized, vendor-neutral option and explain why.
The CCC is valid for two years and must be renewed before it expires. We can keep your controls running, track evidence and remind you well before renewal — so the next contract is never delayed.
Free readiness assessment
Tell us where you are. We’ll map the fastest route.
Free readiness assessment
What you get from the first call
- Your likely classification and whether CCC or CCC+ applies
- The main gaps between your setup and the general requirements
- A fast-track action plan with clear next steps
- An itemised proposal — no obligation
Aramco CCC compliance
Don’t let a missing certificate cost you the next contract.
Book a free readiness assessment today. We’ll tell you exactly what stands between you and your CCC — and get it done.
