Compliance
Aramco CCC Certification: Readiness and Remediation under SACS-210
Aramco CCC certification is the Cybersecurity Compliance Certificate every third party of Aramco Group companies must hold, now assessed against the SACS-210 standard. Waves gets suppliers ready, closes the gaps and prepares the evidence an Authorized Audit Firm needs.
- 150+ companies supported, all passed
- Typical timeline 3–5 weeks
- Updated for SACS-210 (2026)
10 yearsin cybersecurity
150+companies passed Aramco CCC
Gold PartnerSophos & Fortinet
What Aramco CCC certification means for your company
If you supply goods or services to Aramco, SABIC or another Aramco Group company, you need Aramco CCC certification. Aramco's rule is simple: all third parties must obtain the Cybersecurity Compliance Certificate. It shows that your company meets the Third Party Cybersecurity Standard, which is now SACS-210.
The certificate is issued by one of Aramco's Authorized Audit Firms, not by Aramco and not by a consultant. Your job is to have the right controls in place and the evidence to prove it. That is where Waves comes in. We have 10 years in cybersecurity, certified staff, and a track record of 150+ companies supported through Aramco CCC. All of them passed, typically within 3–5 weeks.
- Needed to bid and work with Aramco Group companies
- Accepted by Aramco, SABIC and other Group companies
- Valid for 2 years, then renewed
- Waves is the readiness partner; an Authorized Audit Firm issues the certificate
The Aramco rule behind the CCC
Aramco's supplier page lists seven classifications: General Requirements, Network Connectivity, Outsourced Infrastructure, Customized Software, Cloud Computing, Operational Technology and Critical Data Processor. Your classification decides which SACS-210 controls apply. If you fall under more than one, you must meet the controls for all of them.
There are two certificate types. A CCC is a self-assessment that an Authorized Audit Firm verifies remotely. A CCC+ is an on-site assessment by the audit firm, required for Critical Data Processor suppliers. Aramco currently lists 11 Authorized Audit Firms and says it has no preference among them.
All Aramco Group third parties need a CCC; it is valid for 2 years and checked against SACS-210 (2026).
The SACS-210 general controls to check first
Every supplier must meet the 33 general controls in SACS-210 (TPC1.1 to TPC1.33), whatever its classification. These are the ones worth checking first, because each needs a working setting and evidence, not just a policy.
| Control | What SACS-210 requires | What to do |
|---|---|---|
| TPC1.5, TPC1.6 | Hold a valid CCC and renew it before it expires | Track the expiry date and start the renewal early |
| TPC1.11 | Passwords of 8 to 64 characters, mixed character types, no password hints | Set the policy in Microsoft 365 or Active Directory |
| TPC1.12 | Multi-factor authentication on remote access, cloud services, web and mobile email, internet-facing applications and privileged accounts | Turn on MFA for every email user and admin account |
| TPC1.13 | Single sign-on only when combined with MFA at the first login | Check your SSO settings |
| TPC1.20 | SPF, DKIM and DMARC on your email domain | Publish all three DNS records |
| TPC1.21 to TPC1.24 | Anti-spam inspection, attachment scanning, no generic public email domains, macros from outside blocked | Move off Gmail or Hotmail and switch on mail filtering |
| TPC1.26, TPC1.31 | Audit and security logs kept and protected from changes | Send firewall and server logs to a central, protected store |
| TPC1.30 | Patches tested, or a rollback ready, before production | Write the patch process and keep the evidence |
| TPC1.32 | Tell Aramco within 24 hours of discovering a cyber incident | Write and test an incident response plan |
Source: Aramco SACS-210 Third Party Cybersecurity Standard (February 2026).
The official CCC process in 5 steps
- Prepare. Register on Aramco's Supplier Registration Portal, get the Third Party Classification Template, sign the confirmation letter and put the SACS-210 controls for your classification in place.
- Choose an Authorized Audit Firm. Register on the CCC Portal and send your CCC request to a firm on Aramco's list.
- Assessment. Complete the assessment and documents. The audit firm verifies them remotely for a CCC, or on site for a CCC+, and issues the certificate.
- Submit. Send the certificate and compliance report to Aramco through the e-Marketplace system.
- Renew. The CCC is valid for 2 years. Renew before it expires, or earlier if a new contract adds a classification.
Waves helps with preparation, the assessment documents and renewal. The Authorized Audit Firm issues the certificate.
CCC or CCC+: which do you need?
| CCC | CCC+ | |
|---|---|---|
| Assessment | Self-assessment, verified remotely by an Authorized Audit Firm | On-site assessment by an Authorized Audit Firm |
| Classifications | General Requirements, Outsourced Infrastructure, Customized Software, Cloud Computing, Operational Technology, Network Connectivity | Critical Data Processor |
Aramco's page is not consistent on Network Connectivity: its table lists it under CCC, while its FAQ says CCC+. Confirm with your Aramco contact. See Aramco CCC+ readiness.
How Waves gets you ready for the CCC
Confirm your classification
We review your contract scope and the Classification Template from your Aramco department, so you prepare for the right controls and sign the Confirmation Letter with confidence.
Gap check against SACS-210
We compare your current IT setup and policies with every applicable control and give you a short, prioritised gap list.
Fix the gaps
Our engineers close technical gaps: firewall, MFA, email security, endpoint protection, backup, logging and patching. We also write the missing policies.
Build the evidence pack
We prepare recent, time-stamped evidence and help you complete the self-assessment and Compliance Report the way auditors expect.
Support the audit
You choose an Authorized Audit Firm through the CCC Portal. We stay with you to answer auditor questions and close any follow-up points.
Submit and stay compliant
You upload the certificate and report to Aramco's e-Marketplace. We keep your controls running and remind you before the 2-year renewal.
What is included and who it is for
Gap assessment
A clear list of which SACS-210 controls you meet, partly meet or miss, in plain English.
Policy pack
Cybersecurity policies and procedures written for your company, not a generic template.
Technical remediation
Supply and setup of firewalls, MFA, endpoint protection, backup and email security where needed.
Awareness training
Staff cybersecurity training, which SACS-210 requires every year for all users.
Evidence and report support
Help completing the Compliance Report with the evidence the audit firm will check.
Who it is for
Contractors, service companies, software vendors, cloud providers and OT integrators working with Aramco or SABIC.
A typical CCC readiness timeline: 3 to 5 weeks
| When | What happens |
|---|---|
| Week 1 | Confirm your classification and run a gap check against SACS-210 |
| Weeks 1 to 3 | Fix the gaps: MFA, email records, logging, firewall, policies and awareness training |
| Weeks 3 to 4 | Build the evidence pack and complete the compliance report |
| Weeks 4 to 5 | Assessment by the Authorized Audit Firm and certificate |
Your timeline depends on your classification and how many gaps you start with. The 150+ companies we have supported typically finished in 3 to 5 weeks.
What affects the time and cost of your CCC
- How many classifications apply to you, since each adds specific controls
- Whether you need an on-site CCC+
- How many users, laptops and servers are in scope
- What you already have: firewall, endpoint protection, Microsoft 365 security and backups
- Whether written security policies already exist
- OT systems, which need IEC 62443 certificates under SACS-210 (TPC-2.114 to TPC-2.116)
- The Authorized Audit Firm's own fee, which it sets separately
After a free gap check we give you a fixed quote. WhatsApp us on +966 58 236 5619.
Brands and partners we use to close CCC gaps
SophosFortinetMicrosoftKnowBe4CiscoDellHPEBlancco
Frequently asked questions
Who needs Aramco CCC certification?
Aramco states that all third parties of Aramco Group companies must obtain a CCC. That covers contractors, suppliers and service providers. SABIC and other Group companies accept the same certificate.
Does Waves issue the CCC?
No. Only an Aramco Authorized Audit Firm issues the certificate. Waves is your readiness and remediation partner: we close the gaps and prepare the evidence so the audit goes smoothly.
How long does it take to get a CCC?
For the companies we support, the typical timeline is 3–5 weeks. It depends on how many gaps you start with and how quickly the audit firm schedules your assessment.
What is the difference between CCC and CCC+?
A CCC is a self-assessment that the audit firm verifies remotely. A CCC+ is an on-site assessment by the audit firm and is required for Critical Data Processor suppliers. See our CCC+ page for details.
Is SACS-002 still used?
Aramco's CCC page now names SACS-210 (marked new for 2026) as the standard and no longer refers to SACS-002. New assessments and renewals should be prepared against SACS-210.
How long is the certificate valid?
Two years from the issue date. You must renew before it expires. If you win a contract in a new classification, the audit firm must also assess the controls for that classification.
Which audit firm should we choose?
Aramco lists 11 Authorized Audit Firms and says it has no preference among them. You submit your request through the CCC Portal. We can explain what each step looks like so you can compare quotes and timing.
Start your Aramco CCC with a free gap check
Tell us your classification and contract scope. We will tell you what is missing and how long it should take to close.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
