Compliance guide · October 2026
SACS-210 vs SACS-002: What Changed for Aramco Suppliers in 2026
Short answer: SACS-210 has replaced SACS-002 as the standard behind Aramco’s Cybersecurity Compliance Certificate (CCC). It is dated February 2026, has 149 controls, split into 33 general controls for every supplier plus 116 specific controls that depend on your classification. If your CCC is due for renewal, prepare against SACS-210, not your old SACS-002 checklist.
- 33 general + 116 specific controls
- 7 supplier classifications
- CCC valid for 2 years
10 yearsin cybersecurity
150+companies passed Aramco CCC
Gold PartnerSophos & Fortinet
SACS-210 vs SACS-002 at a glance
Aramco’s CCC programme page now lists SACS-210 as the Third Party Cybersecurity Standard and no longer refers to SACS-002. A new 2026 Compliance Report template has also been published. Here is how the two standards compare.
| SACS-210 | SACS-002 | |
|---|---|---|
| Status | Current standard for the Aramco CCC (2026) | Previous standard (2022) |
| Date | February 2026 | February 2022 |
| Number of controls | 149: 33 general + 116 specific | Withdrawn: no longer on Aramco’s site |
| Control numbering | TPC1.1–TPC1.33 and TPC-2.1–TPC-2.116 | Old TPC numbering |
| Structure | General controls for everyone, then specific controls by classification | One list of controls |
| Compliance Report template | New 2026 template | Older template |
Aramco has not published a list of which individual controls are new, or a separate transition date. In practice, any new CCC assessment or renewal should now be prepared against SACS-210.
The 7 SACS-210 classifications
Your classification decides which of the 116 specific controls apply to you. If more than one classification applies, you must meet the controls of all of them.
General Requirement
Applies to every supplier: the 33 general controls.
Network Connectivity
Your systems connect to Aramco’s network by VPN or leased line.
Outsourced & Managed Services
You run or support outsourced infrastructure, such as a data centre or backup site.
Critical Data Processor
You develop, access or process Aramco confidential data. This needs an on-site CCC+ audit.
Software Services
You build or host custom software, apps or websites for Aramco.
Cloud Computing
You provide IaaS, PaaS or SaaS to Aramco.
Operational Technology
You supply, integrate or maintain OT systems such as DCS, SCADA or PLCs.
8 SACS-210 requirements suppliers should check first
These are the areas where we most often see suppliers fail or delay their CCC.
MFA everywhere it matters
Multi-factor authentication on remote access, cloud services, web and mobile email, internet-facing apps and privileged accounts (TPC1.12).
Email authentication
SPF, DKIM and DMARC on your mail domain, anti-spam and attachment scanning, and a private company domain, not Gmail or Hotmail (TPC1.20–TPC1.23).
Encryption
Data at rest and in transit protected to the advanced level of the Saudi National Cryptographic Standard NCS-1:2020 (TPC1.18).
24-hour incident notice
Tell the Aramco proponent within 24 hours of discovering a cybersecurity incident, then send status updates every 24 hours (TPC1.32).
Logging
Log the required security events and protect the logs. For many classifications, keep logs for at least one year with central logging.
Vulnerability and patching
Monthly internal scans, critical issues fixed immediately and high issues within 7 days on internet-facing systems (specific controls).
Backup and recovery
Regular backups, encrypted off-site copies, tested restores and yearly continuity drills (specific controls).
Awareness training
Yearly mandatory cybersecurity training for all users (TPC-2.26), with extra training for staff who work on OT.
How to move from SACS-002 to SACS-210
Confirm your classification
Ask your Aramco proponent for the classification template. Your classification decides which specific controls apply.
Run a gap check against SACS-210
Map your current setup, policies and evidence to each applicable control. Do not reuse your SACS-002 checklist as-is: the numbering and the number of controls changed.
Fix the gaps that auditors check first
MFA, email authentication, endpoint protection, logging, patching and backups usually decide the result.
Update your policies
Cybersecurity, acceptable use, access control, incident response with the 24-hour notice, backup and disposal.
Collect fresh, time-stamped evidence
Screenshots and reports must clearly show your own environment and be recent.
Book the audit
Choose an Aramco Authorized Audit Firm through the CCC portal and submit the Compliance Report.
Waves Telecom has helped more than 150 companies pass the Aramco CCC, typically in 3 to 5 weeks. We map your current controls to SACS-210 line by line, fix the gaps, write the policies and prepare the evidence for the audit firm.
Frequently asked questions
Has SACS-210 replaced SACS-002?
Yes. Aramco’s Cybersecurity Compliance Certificate (CCC) page now names SACS-210, the Third Party Cybersecurity Standard dated February 2026, and no longer refers to SACS-002. New CCC assessments and renewals should be prepared against SACS-210.
Is my SACS-002 certificate still valid?
A CCC is valid for two years from its issue date. Aramco has not published a separate transition date, so check the expiry date on your certificate and plan your renewal against SACS-210.
How many controls are in SACS-210?
SACS-210 has 33 general controls (TPC1.1 to TPC1.33) that apply to every third party, plus 116 specific controls (TPC-2.1 to TPC-2.116) that apply according to your classification.
Do all 149 controls apply to my company?
No. Every supplier must meet the 33 general controls. The specific controls depend on your classification, such as Network Connectivity, Critical Data Processor or Cloud Computing.
How long does SACS-210 readiness take?
For most small and mid-size suppliers, Waves Telecom completes readiness in 3 to 5 weeks, depending on your classification and starting point. The audit itself is done by an Aramco Authorized Audit Firm.
Who issues the CCC certificate?
An Aramco Authorized Audit Firm verifies your evidence and issues the certificate. Waves Telecom prepares your company: gap check, fixes, policies, evidence and the Compliance Report.
Get ready for SACS-210
Tell us your classification and deadline. We will run a free gap check and send you a clear plan.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
