Aramco CCC Authorized Audit Firms
The official list for your Saudi Aramco CCC certification.
Audit Firm List Overview
Our official list of SACS-002 authorized audit firms ensures you engage a recognized partner for your Cybersecurity Compliance Certification assessment.
- The Complete List of 11 Authorized Firms: Get the full list of all audit firms currently approved by Saudi Aramco.
- Direct Company Contact Information: Each firm listing includes a direct contact email to streamline communication.
- A Ready-to-Use PDF Format: A clean, single-page document for easy reference and sharing.
Official Assessor List
An official list essential for any organization pursuing Aramco CCC certification.
A Sample of Authorized Firms
Seven Technologies
BDO
Deloitte & Touche ME
Ernst & Young (EY)
KPMG
...and 6 more firms
Frequently Asked Questions
Can we choose any cybersecurity auditor we want?
No. Saudi Aramco explicitly mandates that your Third-Party Cybersecurity Compliance Certification (CCC) must be executed exclusively by one of the 11 specifically authorized firms listed within this document. External reports will be entirely rejected.
Does Aramco dictate which of the 11 firms we must hire?
No. As long as you select an auditor actively listed on this official list, you hold the freedom to negotiate pricing, timelines, and procurement contracts directly with the auditing firm of your choice.
What happens if we fail the audit with an Authorized Firm?
If you fail the initial audit, the Authorized Firm will provide you with a documented gap-analysis report. You must remediate these specific vulnerabilities before engaging the firm for a secondary assessment.
Do these firms also help us implement SACS-002 controls?
Typically, No. To prevent conflict of interest, Authorized Audit Firms are heavily restricted to acting strictly as independent assessors. They cannot simultaneously engineer your IT environment and then legally audit their own work.
How frequently is this authorized auditor list updated?
Aramco periodically evaluates existing firms based on their field performance and frequently inducts new authorized groups or terminates underperforming contractors.