Aramco CCC Certification & SACS-210 Compliance
Metrix Cyber prepares Saudi suppliers for the Cybersecurity Compliance Certificate under SACS-210 — from gap analysis to an audit-ready evidence package.
Why the CCC Matters
The Cybersecurity Compliance Certificate (CCC) is mandatory to supply Saudi Aramco. Vendors are assessed against Aramco's Third Party Cybersecurity Standard (SACS-210), which sets the cybersecurity baseline every third party must meet before it can connect to Aramco systems or handle Aramco data.
Without a valid certificate you cannot complete supplier registration, and letting an existing certificate lapse can put active contracts at risk.
Our role is readiness. Metrix Cyber prepares your organisation for assessment. The certificate itself is issued by an Aramco-authorized audit firm — not by Metrix Cyber.
CCC vs CCC+
CCC
A self-assessment, validated remotely by an Aramco-authorized audit firm.
Classifications
- ✓ General Requirements
- ✓ Outsourced Infrastructure
- ✓ Customized Software
- ✓ Cloud Computing
CCC+
An on-site assessment carried out by an Aramco-authorized audit firm.
Classifications
- ✓ Network Connectivity
- ✓ Critical Data Processor
If both apply to your organisation, only CCC+ is required.
What SACS-210 Asks You to Prove
Governance
- ✓ Cybersecurity policies, including acceptable use and data classification
- ✓ A documented incident response plan
- ✓ Defined roles, ownership, and risk management
- ✓ Staff security awareness training
Technical
- ✓ Multi-factor authentication and access management
- ✓ Encryption in transit, email security, and managed firewalls
- ✓ Logging, patching, and malware protection
- ✓ Backup and disaster recovery
The Readiness Process
1. Classify
Determine which classification applies to you, and therefore whether you need CCC or CCC+.
2. Gap Analysis
Measure your current posture against the SACS-210 requirements and size the remaining work.
3. Remediate
Close the gaps — implement the technical controls and write the policies the standard expects.
4. Evidence Package
Produce the compliance report and the supporting evidence an assessor will ask to see.
5. Validation
An Aramco-authorized audit firm validates the assessment and issues the certificate.
A certificate is valid for two years. Renew before it expires to stay eligible, and note that moving into a new classification may require a new certificate.
Frequently Asked Questions
What is the Aramco CCC?
The Cybersecurity Compliance Certificate is Saudi Aramco's mandatory proof that a third-party vendor meets its Third Party Cybersecurity Standard (SACS-210). Without a valid CCC you can't be registered as an Aramco supplier, and a lapse can suspend contracts.
Difference between CCC and CCC+?
CCC is a self-assessment validated remotely (General Requirements, Outsourced Infrastructure, Customized Software, Cloud Computing). CCC+ is an on-site assessment (Network Connectivity, Critical Data Processor). If both apply, only CCC+ is required.
Is SACS-210 the same as SACS-002?
You may see both. SACS-210 is the current designation of Aramco's Third Party Cybersecurity Standard for the CCC, closely aligned with SABIC's requirements; some older materials still say SACS-002. Confirm the version for your contract with your proponent or audit firm.
Who issues the certificate?
Only an Aramco-authorized audit firm. The vendor completes the assessment and evidence; the firm validates (remote for CCC, on-site for CCC+) and issues it. Metrix prepares you and does not issue certificates.
How long is the CCC valid?
Two years from issuance; renew before expiry to stay eligible.
What if I don't have a valid CCC?
You can't be onboarded/renewed as an Aramco supplier and an expired certificate can suspend contracts; there's no buffer once it lapses.
How long does certification take?
Depends on your posture and classification; a gap analysis gives a realistic timeline.
Requirements per Saudi Aramco's official Cybersecurity Compliance Certificate programme page. The certificate is issued by an Aramco-authorized audit firm.
Get your free readiness review
Find out which classification applies to you and what stands between you and an audit-ready evidence package.