If your company is registering as an Aramco supplier, a valid Cybersecurity Compliance Certificate (CCC) is part of the current supplier cybersecurity requirements. The certification is based on the SACS-210 Third Party Cybersecurity Standard, issued in February 2026.
For a business owner, the key is understanding what your company must prepare, who is responsible, how certification works, and when you need implementation support versus an independent audit firm.
Your company implements the cybersecurity requirements that apply to its scope, prepares evidence showing that the controls operate in practice, and an Aramco-authorized audit firm independently verifies the applicable requirements before issuing the certificate.
For the detailed reference, see our Aramco CCC Certification Guide 2026.
What Is Aramco CCC?
The Cybersecurity Compliance Certificate (CCC) is part of Aramco’s third-party cybersecurity program. The current program uses SACS-210 and requires third parties to obtain a CCC, or an approved certificate, from an authorized audit firm according to the applicable requirements.
The process is straightforward: determine the applicable scope, implement the required controls, prepare evidence, and complete independent verification through an Authorized Audit Firm.
Buying a security product, writing policies, or completing a checklist does not create the certificate. Those activities support readiness, but certification remains separate.
Review the current standard through our SACS-210 resource page or the official Aramco CCC program.
SACS-210 Is the Current Aramco Third-Party Cybersecurity Standard
If you researched Aramco CCC before 2026, you may have seen references to SACS-002. That is legacy material. The current standard is SACS-210, issued in February 2026.
SACS-210 contains 33 General Requirements, from TPC1.1 through TPC1.33. They cover policies, employee lifecycle, asset inventory, identity and access management, MFA, data protection, email security, endpoint protection, logging, incident response, and certification. Specific Requirements can also apply depending on the third party’s classification.
Do not plan a 2026 CCC project using an old SACS-002 checklist. Start with SACS-210 and confirm whether your company’s business relationship or Third Party Classification introduces additional requirements.
For companies still in the supplier-registration phase, the starting point is the General Requirements. If your company already has an active procurement relationship with Aramco, the relevant Aramco department you work with—the proponent—participates in determining the Third Party Classification.
If still registering, see our Aramco Supplier Registration 2026 guide.
What Does a Business Owner Need to Prepare?
You do not need to personally configure every technical control. You do need to make sure the company can answer four questions.
What is the scope? Identify the legal entity, users, systems, services, assets, and data relevant to the Aramco relationship.
Who owns cybersecurity responsibilities? IT, HR, management, incident response, and compliance evidence should all have clear owners.
Is the current IT environment suitable? Some businesses can remediate what they already use; others may need a new controlled environment for the relevant CCC scope.
Can the company prove implementation? Evidence may include policies, screenshots, registers, logs, training records, and approvals.
Documentation without implementation is insufficient, and implementation without usable evidence can still create problems during verification.
Who Is Responsible for What?
Business management owns scope, resources, approvals, and organizational decisions. IT or an implementation provider handles technical controls, configuration, documentation, and evidence preparation. The Authorized Audit Firm independently assesses or verifies the applicable requirements and issues the certificate.
An implementation provider should not promise a guaranteed CCC result. Certification depends on the actual environment, scope, evidence, and independent assessment.
How to Get Aramco CCC Certification
For a business owner, the process can be reduced to five steps.
1. Confirm your stage and scope
If you are registering as a supplier, start with the SACS-210 General Requirements. If you already have an active Aramco procurement relationship, confirm your Third Party Classification and additional requirements.
2. Implement the applicable controls
This may include policies, access controls, MFA, asset management, email security, endpoint protection, logging, and incident response. For implementation detail, use the SACS-210 Technical Implementation Checklist.
3. Prepare the evidence
Current assessment guidance expects evidence to be clear, readable, time stamped, and demonstrably related to the third party.
4. Select an Authorized Audit Firm
The audit firm performs the independent certification assessment and is separate from the implementation provider. See the current Aramco CCC Authorized Audit Firms resource.
5. Complete the assessment and submit the certificate
The CCC Portal is the current channel for certification requests and communication with the selected audit firm. After successful completion, the certificate and Compliance Report are submitted through Aramco’s applicable supplier process, including e-Marketplace.
CCC is valid for two years from issuance, and SACS-210 requires renewal before expiry.
Do You Need CCC or CCC+?
The certificate route depends on the company’s confirmed Third Party Classification.
CCC applies to the General Requirements and classifications that do not require CCC+. It uses a self-assessment followed by remote verification by an Authorized Audit Firm.
Network Connectivity and Critical Data Processor require CCC+, which involves an on-site assessment by an Authorized Audit Firm. If both CCC and CCC+ apply, Aramco states that only CCC+ is accepted.
Do not guess the certificate type from company size or contract value. Confirm the classification first.
For detailed classification, use the full Aramco CCC Certification Guide 2026.
Should You Use a New CCC Environment or Your Existing IT?
A new dedicated environment can be suitable when the company does not already have a managed environment appropriate for the relevant CCC scope. NHR’s Aramco CCC Kit is designed around this model when it is suitable for the applicant.
If your existing devices, Microsoft 365 services, email, domain, servers, applications, or network infrastructure must remain within scope, the better route may be to assess and remediate the existing environment through Aramco CCC Implementation.
A dedicated CCC environment is an implementation option—not a requirement in SACS-210 and not a way to exclude systems, assets, or data that genuinely fall within the applicable cybersecurity scope.
Where NHR Fits in the Aramco CCC Process
NHR Alemtithal supports Saudi businesses with implementation, remediation, documentation, evidence preparation, and assessment readiness.
NHR Alemtithal is not Saudi Aramco and is not an Authorized Audit Firm issuing CCC certificates. Independent assessment and certificate issuance are performed through an Authorized Audit Firm.
Need More Detail?
For details on all 33 General Requirements, classification, CCC versus CCC+, evidence, audit preparation, renewal, and technical implementation, continue to the Aramco CCC Certification Guide 2026.
If your company is still registering, use the Aramco Supplier Registration 2026 guide. For a new managed environment, review the Aramco CCC Kit. If your current environment must remain in scope, review the CCC Implementation Service.
Disclaimer
No implementation service or product guarantees issuance of a CCC, a successful current or future assessment, eligibility for a particular contract, or protection against all cybersecurity incidents.
Applicable requirements and assessment scope depend on the current SACS-210 standard, the third party’s classification, business relationship, and relevant systems, assets, and data.
Need help with Aramco CCC Certification?
Get a Free Expert Consultation.
