Free SACS-210 Readiness Checklist

1. Do you know your Third Party classification(s)?SACS-210 Section 3

2. Have you received the Classification Template and signed the Classification Confirmation Letter?CCC programme

3. Do you know whether you need CCC (remote) or CCC+ (on-site assessment)?CCC programme

4. Do you know the expiry date of your current certificate (valid 2 years)?TPC1.5, TPC1.6

5. Are you registered on the Supplier Registration Portal and the CCC Portal?CCC programme

6. Do you have an approved cybersecurity policy and a named person responsible for cybersecurity?

7. Do subcontractors supporting Aramco work follow the same cybersecurity and data-privacy requirements?SACS-210 scope

8. Is there a process to securely return or delete Aramco data when a contract ends?TPC1.16

9. Do passwords / passphrases meet the required length (8 to 64 characters)?TPC1.11

10. Is MFA enabled for remote access, cloud services, web/mobile email, internet-facing apps and privileged accounts?TPC1.12

11. Are admin accounts separate from normal user accounts and reviewed regularly?

12. Is sensitive data encrypted at rest and in transit (advanced level of NCS-1:2020)?TPC1.18

13. Are old disks and devices securely wiped or destroyed, with a record kept?TPC-2.45

14. Do you know where Aramco data is stored and that it meets any data-location restriction?TPC-2.29, TPC-2.30

15. Are SPF, DKIM and DMARC configured on your email domain?TPC1.20-1.23

16. Do you use anti-spam and inspect email attachments?TPC1.20-1.23

17. Does all business email use your own company domain (not Gmail, Hotmail, etc.)?TPC1.20-1.23

18. Is EDR installed on all computers and servers?TPC-2.54

19. Do you run internal vulnerability scans every month?TPC-2.85

20. Are critical vulnerabilities fixed immediately, and high ones within 7 days (internet-facing) or 2 weeks (internal)?TPC-2.88, TPC-2.89

21. Do you run periodic penetration tests, including internet-facing services?TPC-2.86, TPC-2.87

22. Are security events logged centrally (e.g. SIEM) and kept for at least 1 year?TPC1.31

23. Can you notify your Aramco proponent within 24 hours of discovering a cybersecurity incident?TPC1.32

24. Do you have an incident response procedure covering interim and final reports?Appendix B

25. Are backups taken regularly, with an encrypted off-site copy?TPC-2.36, TPC-2.37

26. Have you tested restoring from backup, with a record of the test?TPC-2.109

27. Do you run a business continuity drill at least once a year?TPC-2.107

28. Do all users complete cybersecurity awareness training every year, with records?TPC-2.26

29. Do your OT products, systems or services hold the IEC 62443 certifications for your subcategory?Appendix D

30. Do you follow Secure-by-Design and provide extra OT awareness training?TPC-2.112, TPC-2.113