Aramco’s TPC-1: Your Guide to Crafting a Robust Cybersecurity AUP

Aramco’s cybersecurity standards, outlined in SACS-002 Third Party Cybersecurity Standard, aim to protect sensitive data and ensure secure connectivity. One crucial control is TPC-1 , which mandates the establishment of a comprehensive Cybersecurity Acceptable Use Policy (AUP).

Why Is an AUP Important?

An AUP is critical for:

• Establishing clear guidelines on technology asset usage.
• Ensuring compliance with Aramco’s cybersecurity requirements.
• Protecting sensitive data and minimizing security risks.

Crafting Your Cybersecurity Acceptable Use Policy

To comply with TPC-1, your AUP should include the following elements:

1. Purpose and Scope

• Clearly state the purpose of the AUP.
• Define its scope, including who it applies to and what types of assets are covered.

2. Policy Statement

• Describe your organization’s commitment to cybersecurity.
• Outline the expectations for employees regarding technology asset usage.

3. Roles and Responsibilities

• Define roles and responsibilities related to AUP enforcement and compliance.

4. Acceptable Use

• Detail permitted uses of technology assets, such as:
  • Work-related tasks
  • Limited personal use (if allowed)
  • Prohibited activities, like accessing inappropriate content or engaging in illegal activities

5. Unacceptable Use

• Clearly outline what constitutes unacceptable use of technology assets.

6. Enforcement and Consequences

• Describe how policy violations will be detected, investigated, and addressed.
• Outline the consequences for non-compliance, which may include disciplinary actions or termination.

Implementing Your AUP

Once you’ve crafted your AUP:

1. Obtain approval from management.
2. Communicate the policy to all relevant employees.
3. Provide training on the AUP to ensure understanding and compliance.
4. Regularly review and update the policy as needed.

Need Assistance with TPC-1 Compliance?

At NHR Alemtithal for IT, we specialize in helping organizations comply with Aramco’s cybersecurity controls. Our Aramco All-in-One Compliance Kit service ensures you meet all requirements, including TPC-1.

Contact us today:

• Phone: +966 55 653 8840
• Email: info@nhr.com.sa