Compliance
Aramco CCC Certification: Readiness and Remediation under SACS-210
Aramco CCC certification is the Cybersecurity Compliance Certificate every third party of Aramco Group companies must hold, now assessed against the SACS-210 standard. Waves gets suppliers ready, closes the gaps and prepares the evidence an Authorized Audit Firm needs.
- 150+ companies supported, all passed
- Typical timeline 3–5 weeks
- Updated for SACS-210 (2026)
10 yearsin cybersecurity
150+companies passed Aramco CCC
Gold PartnerSophos & Fortinet
What Aramco CCC certification means for your company
If you supply goods or services to Aramco, SABIC or another Aramco Group company, you need Aramco CCC certification. Aramco's rule is simple: all third parties must obtain the Cybersecurity Compliance Certificate. It shows that your company meets the Third Party Cybersecurity Standard, which is now SACS-210.
The certificate is issued by one of Aramco's Authorized Audit Firms, not by Aramco and not by a consultant. Your job is to have the right controls in place and the evidence to prove it. That is where Waves comes in. We have 10 years in cybersecurity, certified staff, and a track record of 150+ companies supported through Aramco CCC. All of them passed, typically within 3–5 weeks.
- Needed to bid and work with Aramco Group companies
- Accepted by Aramco, SABIC and other Group companies
- Valid for 2 years, then renewed
- Waves is the readiness partner; an Authorized Audit Firm issues the certificate
The Aramco rule behind the CCC
Aramco's supplier page lists seven classifications: General Requirements, Network Connectivity, Outsourced Infrastructure, Customized Software, Cloud Computing, Operational Technology and Critical Data Processor. Your classification decides which SACS-210 controls apply. If you fall under more than one, you must meet the controls for all of them.
There are two certificate types. A CCC is a self-assessment that an Authorized Audit Firm verifies remotely. A CCC+ is an on-site assessment by the audit firm, required for Critical Data Processor suppliers. Aramco currently lists 11 Authorized Audit Firms and says it has no preference among them.
All Aramco Group third parties need a CCC; it is valid for 2 years and checked against SACS-210 (2026).
How Waves gets you ready for the CCC
Confirm your classification
We review your contract scope and the Classification Template from your Aramco department, so you prepare for the right controls and sign the Confirmation Letter with confidence.
Gap check against SACS-210
We compare your current IT setup and policies with every applicable control and give you a short, prioritised gap list.
Fix the gaps
Our engineers close technical gaps: firewall, MFA, email security, endpoint protection, backup, logging and patching. We also write the missing policies.
Build the evidence pack
We prepare recent, time-stamped evidence and help you complete the self-assessment and Compliance Report the way auditors expect.
Support the audit
You choose an Authorized Audit Firm through the CCC Portal. We stay with you to answer auditor questions and close any follow-up points.
Submit and stay compliant
You upload the certificate and report to Aramco's e-Marketplace. We keep your controls running and remind you before the 2-year renewal.
What is included and who it is for
Gap assessment
A clear list of which SACS-210 controls you meet, partly meet or miss, in plain English.
Policy pack
Cybersecurity policies and procedures written for your company, not a generic template.
Technical remediation
Supply and setup of firewalls, MFA, endpoint protection, backup and email security where needed.
Awareness training
Staff cybersecurity training, which SACS-210 requires every year for all users.
Evidence and report support
Help completing the Compliance Report with the evidence the audit firm will check.
Who it is for
Contractors, service companies, software vendors, cloud providers and OT integrators working with Aramco or SABIC.
Brands and partners we use to close CCC gaps
SophosFortinetMicrosoftKnowBe4CiscoDellHPEBlancco
Frequently asked questions
Who needs Aramco CCC certification?
Aramco states that all third parties of Aramco Group companies must obtain a CCC. That covers contractors, suppliers and service providers. SABIC and other Group companies accept the same certificate.
Does Waves issue the CCC?
No. Only an Aramco Authorized Audit Firm issues the certificate. Waves is your readiness and remediation partner: we close the gaps and prepare the evidence so the audit goes smoothly.
How long does it take to get a CCC?
For the companies we support, the typical timeline is 3–5 weeks. It depends on how many gaps you start with and how quickly the audit firm schedules your assessment.
What is the difference between CCC and CCC+?
A CCC is a self-assessment that the audit firm verifies remotely. A CCC+ is an on-site assessment by the audit firm and is required for Critical Data Processor suppliers. See our CCC+ page for details.
Is SACS-002 still used?
Aramco's CCC page now names SACS-210 (marked new for 2026) as the standard and no longer refers to SACS-002. New assessments and renewals should be prepared against SACS-210.
How long is the certificate valid?
Two years from the issue date. You must renew before it expires. If you win a contract in a new classification, the audit firm must also assess the controls for that classification.
Which audit firm should we choose?
Aramco lists 11 Authorized Audit Firms and says it has no preference among them. You submit your request through the CCC Portal. We can explain what each step looks like so you can compare quotes and timing.
Start your Aramco CCC with a free gap check
Tell us your classification and contract scope. We will tell you what is missing and how long it should take to close.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
