SACS-210 Compliance Kit: Your Complete Guide to Saudi Aramco Cybersecurity Certification (Feb 2026 Standard)

Why SACS-210 Compliance Is Critical for Saudi Aramco Vendors in 2026

If your organization processes, stores, or transmits data for Saudi Aramco—or connects to its corporate network—you must comply with the Third-Party Cybersecurity Standard (SACS-210), updated February 2026.

This isn’t optional. To maintain or win contracts, you must demonstrate compliance through a Cybersecurity Compliance Certificate (CCC) issued by an authorized audit firm licensed in Saudi Arabia. Failure to meet the General Requirements (controls TPC1.1 through TPC1.33) can delay projects, trigger contract reviews, or disqualify your vendor status entirely.

Yet building compliant policies, registers, and audit evidence from scratch is complex, time-consuming, and risky. One missing control or misaligned procedure can mean audit failure.

As a locally based Saudi provider, NHR Alemtithal understands the exact pressure points businesses face when navigating these strict regulatory environments. That’s why we engineered a solution to eliminate the administrative friction.

Introducing: SACS-210 Compliance Kit (Feb 2026 Standard)

Complete Documentation Suite for Auditor-Ready Compliance

💡 Fast-track your Saudi Aramco Cybersecurity Compliance Certificate (CCC) with our comprehensive, auditor-aligned documentation toolkit. Designed specifically for the updated SACS-210 (February 2026) General Requirements (TPC1.1 – TPC1.33), this kit saves you weeks of drafting and is structured to maximize audit readiness.

Whether you’re preparing for your first CCC audit or renewing an existing certificate, this premium digital suite provides the exact administrative foundation authorized Saudi Aramco auditors expect to see.

🔗 Get Instant Access to the SACS-210 Compliance Kit

What’s Inside the SACS-210 Compliance Kit?

Your digital download includes a professionally organized folder structure with 17 customizable templates (MS Word & Excel) plus a step-by-step implementation guide—everything you need to satisfy SACS-210 General Requirements while aligning with NCA ECC 2:2024 and Saudi PDPL frameworks.

01 Policies (The Governance Foundation)

• Cybersecurity Policy: Master governance document mapped directly to SACS-210 and NCA ECC domains, covering all required controls from asset management to incident response.
• Acceptable Use Policy (AUP): Defines remote work, AI usage, password rules, and staff responsibilities per TPC1.2 and TPC1.3 requirements.

02 Forms (Operational Evidence for Auditors)

• AUP Acknowledgment Form – Employee acceptance tracking
• Employee Onboarding Checklist Form – Background checks per TPC1.4
• Employee Offboarding Checklist Form – Critical for TPC1.4 & TPC1.17 (asset return and access removal)
• Policy Exception Request Form – Documented deviation management
• Third-Party Classification Confirmation Letter – Scope definition
• Inapplicable Controls Form Template – Justification documentation

03 Registers (Dynamic Excel Trackers)

• Asset Inventory Register: Tracks hardware, software, and data repositories to satisfy TPC1.8 requirements with automated categorization and ownership assignment.
• Legislative & Regulatory Register: Live compliance tracker and quarterly self-assessment matrix for TPC1.1, ensuring continuous compliance with KSA cybersecurity and data privacy regulations.

04 Reports (Audit Deliverables)

• Access Review Report – Mandatory for TPC1.15 (annual user access reviews)
• Interim Status Report – For Incident Response SLAs per Appendix A (24-hour notification requirement)
• Final Technical Report – Detailed incident analysis per Appendix B.2-2
• Final Business Report – Executive summary per Appendix B.2-1

05 Official Letters & Memos

• Confirmation and Commitment for Current Environmental Status
• Ownership Confirmation Memo
• Remote Access Inapplicability Letter
• Procedure for Grant of Access to Aramco Vendor Portal

Bonus: The SACS-210 User Guide

• Step-by-step PDF guide explaining exactly how to customize each document.
• Granular Technical Implementation Checklist for your IT team (covering MFA per TPC1.12, firewalls per TPC1.27, backups per TPC2.36, log protection per TPC1.26).
• Quick-reference control mapping table.

Key Features Built for Saudi Market Success

✅ 100% Up-to-Date for Feb 2026 Standard Built specifically for the latest SACS-210 release—no outdated templates or legacy controls. Verified against the February 2026 publication.

✅ Plug-and-Play Customization All documents feature clear, bracketed placeholders (e.g., [Company Name], [General Manager]) for rapid customization using Word’s “Find and Replace” tool.

✅ Seamless Tech Stack Integration These standardized .DOCX and .XLSX files are designed to be easily imported into your existing document management and operations software, whether you are utilizing SharePoint, ERPNext, or a centralized company intranet.

✅ Auditor-Aligned Format Structured to present evidence exactly how Saudi Aramco’s authorized auditing firms expect to see it—reducing back-and-forth and accelerating approval timelines.

✅ Aligned with KSA Regulatory Frameworks Templates map to both National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) 2:2024 and Saudi Personal Data Protection Law (PDPL), supporting broader compliance beyond Aramco.

✅ Instant Digital Access Download your .ZIP file immediately after purchase and start your compliance journey today—no waiting, no shipping.

Who Is the SACS-210 Compliance Kit For?

• Current & Prospective Saudi Aramco Vendors, Suppliers, and Contractors Prove your cybersecurity posture meets SACS-210 General Requirements without hiring expensive consultants. Supporting businesses in Riyadh, Jeddah, Dammam, and across the Kingdom.
• IT Managed Service Providers (MSPs) in KSA Deliver compliant documentation services to your Aramco-bound clients with confidence and speed.
• Compliance Officers & IT Managers Tasked with obtaining or renewing the CCC certificate? This kit gives you a structured, defensible starting point.

• Important Note: This kit covers the baseline General Requirements (TPC1.1–TPC1.33) applicable to ALL third parties under SACS-210. It does not include specific technical addendums for:
  • Cloud Computing (IaaS/PaaS/SaaS) – Section 7
  • Critical Data Processors – Section 3
  • Operational Technology (OT) – Section 3 & Appendix D
• Those classifications require additional controls per Sections 3 and 6 of the standard.

How the Kit Maps to SACS-210 General Requirements (TPC1.1 – TPC1.33)

Control Area	Key Controls Addressed	Kit Component
Governance & Policy	TPC1.1 (Regulatory), TPC1.2–1.3 (Policies), TPC1.4 (On/Offboarding)	Cybersecurity Policy, AUP, On/Offboarding Forms, Legislative Register
Asset Management	TPC1.8 (Asset Inventory)	Asset Inventory Register (Excel)
Access Control	TPC1.9–1.15 (IAM, MFA, Access Reviews)	Access Review Report, Remote Access Letter, Policy templates
Data Security	TPC1.16–1.26 (Encryption, Email Security, Log Protection)	Policy templates + Technical Checklist (SPF/DMARC/DKIM per TPC1.20)
Platform Security	TPC1.27–1.30 (Firewalls, WAF, AV, Patching)	Technical Implementation Checklist
Incident Response	TPC1.32 (24-hr notification), TPC1.33 (Access revocation)	Interim/Final Report Templates per Appendix A & B
Audit & Monitoring	TPC1.31 (Logging per Appendix C)	Logging guidance in User Guide + Report Templates

Critical SACS-210 Requirements You Must Meet

TPC1.32: 24-Hour Incident Notification

If you discover a cybersecurity incident, you must notify the proponent (e.g., Saudi Aramco SOC at +966(13)-880-0000) within 24 hours, followed by interim reports every 24 hours until resolution (per Appendix A).

• Our kit includes: Ready-to-use Interim Status Report and Final Report templates aligned with Appendix B requirements.

TPC1.12: Multi-Factor Authentication (MFA)

MFA must be enforced on: remote access (including Internet access), cloud services, company email via web/mobile, internet-facing applications, and privileged accounts.

• Our kit includes: Technical Implementation Checklist with MFA configuration guidance.

TPC1.8: Asset Inventory

You must maintain an effective mechanism to inventory all information and technology assets.

• Our kit includes: Dynamic Excel Asset Inventory Register with automated tracking.

TPC1.18: Encryption Standards

Data at rest and in transit must be encrypted using KSA National Cryptographic Standards (NCS-1:2020) advanced level.

• Our kit includes: Encryption policy templates and key management procedures.

Key Terms Defined (Glossary)

CCC (Cybersecurity Compliance Certificate): Required per TPC1.5 for Saudi Aramco vendors. Must be obtained from authorized audit firms and renewed before expiration (TPC1.6).

TPC1.x Controls: Control identifiers in SACS-210 General Requirements section (TPC1.1 through TPC1.33).

NCA ECC (National Cybersecurity Authority Essential Cybersecurity Controls): Saudi Arabia’s baseline cybersecurity framework. SACS-210 aligns with ECC 2:2024.

PDPL (Personal Data Protection Law): Saudi law governing personal data processing. SACS-210 includes data privacy requirements.

Proponent: The Saudi Aramco entity or subsidiary (e.g., SABIC) engaging the third party.

Important Disclaimer: Templates Support—But Don’t Guarantee—Certification

⚠️ The SACS-210 Compliance Kit provides templates and guidance to support compliance efforts. Template usage alone does not constitute certification.

Full compliance requires:

• Technical implementation of security controls (e.g., configuring firewalls per TPC1.27, enabling MFA per TPC1.12)
• Staff training and awareness programs (TPC1.3, TPC2.26)
• Evidence generation over operational periods
• Validation through an authorized third-party audit firm licensed in Saudi Arabia

Organizations remain solely responsible for their cybersecurity posture and audit outcomes.

Format: .DOCX (Microsoft Word) and .XLSX (Microsoft Excel) in a compressed .ZIP file

Delivery: Instant Digital Download

Support: Available AST (UTC+3), Sunday–Thursday

Frequently Asked Questions (FAQ)

Q1: Does the SACS-210 Compliance Kit guarantee CCC certification?
A: No. The kit provides auditor-ready templates to support compliance efforts. Full certification requires technical implementation of controls, staff training, evidence generation over operational periods, and validation by an authorized Saudi-licensed audit firm per TPC1.5 and TPC1.6.

Q2: Which SACS-210 classifications does this kit cover?
A: This kit covers the baseline General Requirements (TPC1.1–TPC1.33) applicable to ALL third parties. Specific addendums for Cloud Computing (IaaS/PaaS/SaaS), Critical Data Processors, or Operational Technology (OT) require additional controls per Sections 3 and 6 of the SACS-210 standard.

Q3: How quickly must I report a cybersecurity incident under SACS-210?
A: Per TPC1.32 and Appendix A, third parties must notify the proponent (e.g., Saudi Aramco SOC) within 24 hours of discovering a cybersecurity incident, followed by interim reports every 24 hours until resolution.

Q4: Can I customize the templates for my organization?
A: Yes. All documents feature bracketed placeholders (e.g., [Company Name], [General Manager]) for rapid customization using Word’s “Find and Replace” tool. The included User Guide provides step-by-step customization instructions.

Q5: Is this kit aligned with NCA ECC and Saudi PDPL?
A: Yes. The templates map to both NCA Essential Cybersecurity Controls (ECC) 2:2024 and Saudi Personal Data Protection Law (PDPL), supporting broader regulatory compliance beyond Saudi Aramco requirements.

Q6: How long does it take to implement the kit?
A: Most organizations can customize the core policies and forms within 1-2 weeks. However, full compliance requires ongoing technical implementation, staff training, and evidence generation over operational periods before audit.

Ready to Accelerate Your SACS-210 Compliance Journey?

Don’t let documentation delays jeopardize your Saudi Aramco contracts. With the SACS-210 Compliance Kit (Feb 2026 Standard), you get a head start on auditor-aligned evidence, time saved to focus on implementing controls, and templates structured precisely per authorized audit firm expectations.

👉 Get Instant Access to the SACS-210 Compliance Kit Now