Compliance
Aramco CCC+: Get Ready for the On-Site Assessment
Aramco CCC+ is the version of the Cybersecurity Compliance Certificate where an Authorized Audit Firm assesses your controls on site. It is required for suppliers classified as Critical Data Processor.
- On-site readiness against SACS-210
- 150+ companies passed CCC with Waves
- Mock walkthrough before the auditor arrives
10 yearsin cybersecurity
150+companies passed Aramco CCC
Gold PartnerSophos & Fortinet
What Aramco CCC+ is and how it differs from CCC
Aramco offers two certificate types under its CCC programme. With a standard CCC, you complete a self-assessment and an Authorized Audit Firm verifies it remotely. With Aramco CCC+, the audit firm runs the compliance assessment on site against the Third Party Cybersecurity Standard, SACS-210.
On site, the auditor does not only read your documents. They can look at your systems, settings, logs and physical controls as they actually run. Gaps that a well-written report might hide become visible. That is why CCC+ readiness needs real, working controls and staff who can show them.
- CCC: self-assessment, verified remotely
- CCC+: on-site assessment by the audit firm
- Both are valid for 2 years
- Both are issued only by an Aramco Authorized Audit Firm
Who needs CCC+: what Aramco's page says
Aramco's classification table assigns CCC+ to Critical Data Processor suppliers. SACS-210 defines this as a third party that develops, accesses or processes confidential data. All other classifications in the table, including Network Connectivity, are listed under the standard CCC.
However, the FAQ on the same Aramco page says CCC+ is required for third parties classified as Network Connectivity or Critical Data Processor. Network Connectivity means your infrastructure connects to Aramco's network, for example by leased line or VPN. Because the page is ambiguous, confirm with your Aramco proponent or TPCybersecurity@aramco.com before you plan. If you have a network link, we prepare you to on-site standard either way.
CCC+ applies to Critical Data Processor; Aramco's FAQ also lists Network Connectivity, but its own table does not.
How Waves prepares you for a CCC+ visit
Confirm classification
We review your contract and the Classification Template, and help you get written confirmation if Network Connectivity applies.
On-site gap assessment
We visit your office and check each applicable SACS-210 control the way an auditor would, not just on paper.
Fix the gaps
We implement the missing controls: MFA, data encryption, segregation of confidential data, logging, endpoint detection, backup and secure disposal.
Prepare your team
We brief the people the auditor will speak to, so they can show controls and explain procedures clearly.
Mock walkthrough
We run a practice assessment on site and fix anything that does not hold up.
Support on the day
Before the visit you submit the classification template and confirmation letter. We help you prepare and answer follow-up points afterwards.
Controls auditors often check on site
Confidential data handling
Logical or physical segregation of Aramco data, data-location limits and secure return or deletion when the work ends.
Encryption
Data at rest and in transit protected to the advanced level of NCS-1:2020.
Access and MFA
MFA on remote access, cloud, email and privileged accounts, with access reviewed and limited.
Logging and monitoring
Central logging, the required audit events, and logs kept for at least one year.
Secure disposal
Sanitisation and disposal of drives and devices that held company data, with records.
Who it is for
Critical Data Processor suppliers, and companies with a network link to Aramco that want to be ready for an on-site review.
Brands and partners for CCC+ controls
SophosFortinetMicrosoftBlanccoKnowBe4CiscoDellHPE
Frequently asked questions
Does Network Connectivity need CCC+ or CCC?
Aramco's page is not consistent. The classification table lists Network Connectivity under CCC, while the FAQ says CCC+ is required for it. Ask your Aramco proponent or TPCybersecurity@aramco.com to confirm in writing.
What is a Critical Data Processor?
Under SACS-210, it is a third party that develops, accesses or processes confidential data. If your contract gives you access to Aramco's confidential information, expect this classification and a CCC+.
Who carries out the CCC+ assessment?
One of Aramco's Authorized Audit Firms carries out the on-site assessment, generates the report and issues the certificate. Waves prepares you for it; we do not issue certificates.
Is CCC+ harder to pass than CCC?
The controls come from the same SACS-210 standard, but the auditor checks them in person. Weak points such as untested backups or missing logs are easier to spot. Good preparation makes the visit straightforward.
How long does CCC+ preparation take?
Our typical CCC timeline is 3–5 weeks. A CCC+ depends on how many gaps you start with and on the audit firm's visit date, so we give you a realistic plan after the gap assessment.
Is a CCC+ also valid for two years?
Aramco states the certificate is valid for two years from issue and must be renewed before it expires. That applies to the programme as a whole.
Prepare for your CCC+ on-site assessment
Tell us your classification and how you connect to Aramco. We will show you what an on-site auditor will look for and what to fix first.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
