Compliance
SACS-210 Requirements: Aramco's 2026 Third Party Cybersecurity Standard
SACS-210 is the Third Party Cybersecurity Standard that Aramco now uses for its Cybersecurity Compliance Certificate (CCC). Every supplier of Aramco Group companies is assessed against the SACS-210 requirements that match its classification.
- SACS-210 dated February 2026
- 150+ companies passed CCC with Waves
- Gap check mapped to your classification
10 yearsin cybersecurity
150+companies passed Aramco CCC
Gold PartnerSophos & Fortinet
What SACS-210 is and who it applies to
SACS-210 is the Third-Party Cybersecurity Standard published by Aramco, dated February 2026. Aramco's CCC page marks it as new for 2026 and uses it as the standard behind every CCC. If you want to understand the SACS-210 requirements, start with who is in scope.
The standard applies to third parties that process, transmit or store Aramco information or personal data, access a company endpoint, provide off-the-shelf or customised technical products, connect to the company network, or provide consultancy on high-sensitivity national projects. It also says you must make sure your subcontractors follow the applicable requirements.
- General Requirement: applies to every third party
- Network Connectivity: your infrastructure connects to Aramco's network by leased line or VPN
- Outsourced and Managed Services: for example data centres or backup centres
- Critical Data Processor: you develop, access or process confidential data
- Software Services: customised software, applications or websites
- Cloud Computing: IaaS, PaaS or SaaS
- Operational Technology: OT products, systems, integration and lifecycle services
What changed from SACS-002 to SACS-210
Here is what we can confirm from Aramco's documents. Aramco's CCC page now names SACS-210 and no longer refers to SACS-002, and a new 2026 Compliance Report Template has been published. The control set is larger and renumbered: SACS-210 has 33 general controls (TPC1.1 to TPC1.33) and 116 specific controls (TPC-2.1 to TPC-2.116). SACS-002 (2022) had 92 controls, numbered TPC-1 to TPC-92.
SACS-210 also groups its controls under six functions: Govern, Identify, Protect, Detect, Respond and Recover, with a separate block of additional OT requirements. Aramco has not published a transition date or a list of which individual controls are new. SACS-210 is the current standard (2026), and Waves maps your existing controls to it line by line, so nothing is missed.
SACS-210 (February 2026): 33 general + 116 specific controls, against 92 in SACS-002 (2022).
Key SACS-210 controls suppliers should check first
Multi-factor authentication
MFA on remote access, cloud services, web and mobile email, internet-facing apps and privileged accounts (TPC1.12).
Email security
SPF, DKIM and DMARC on your mail domain, anti-spam and attachment scanning, and a private company domain, not Gmail or Hotmail (TPC1.20–1.23).
Encryption
Data at rest and in transit protected to the advanced level of the Saudi National Cryptographic Standards, NCS-1:2020 (TPC1.18).
Incident reporting
Notify the Aramco proponent within 24 hours of discovering a cybersecurity incident and follow the response process in Appendix A (TPC1.32).
Logging and monitoring
Log the required events, keep logs for at least one year, and use central logging (specific controls).
Vulnerability management
Monthly internal scans; critical issues fixed immediately, high issues within 7 days on internet-facing systems (specific controls).
Backup and recovery
Regular backups, encrypted off-site copies and tested restores, plus yearly continuity drills (specific controls).
Awareness training
Yearly mandatory cybersecurity training for all users, with extra training for staff who access OT (TPC-2.26, TPC-2.112).
How Waves maps you to SACS-210
Confirm classification
We match your contract scope to the seven SACS-210 classifications, since your classification decides which specific controls apply.
Line-by-line gap check
We test each applicable control against your current setup and mark it met, partly met or missing.
Remediation plan
You get a short, prioritised fix list with effort and cost, starting with the controls auditors check most closely.
Fix and document
Our engineers implement the fixes and write the policies, then collect time-stamped evidence for each control.
Audit support
We help you complete the Compliance Report and answer the Authorized Audit Firm's questions.
Brands and partners for SACS-210 controls
FortinetSophosMicrosoftKnowBe4CiscoDellHPEBlancco
SACS-210 PDF and free readiness checklist
Aramco publishes the SACS-210 Third Party Cybersecurity Standard (February 2026) as a PDF on its supplier website. It lists the general controls every third party must meet and the extra controls for each CCC classification.
The PDF tells you what is required. It does not tell you where your company stands today. Our free SACS-210 readiness checklist turns the standard into plain yes/no questions about your firewall, endpoints, email, backups, MFA, patching and policies, so you can see your gaps in about 20 minutes.
SACS-210 checklist covers
- Asset inventory and classification
- Firewall and network segmentation
- Endpoint protection and patching
- MFA and privileged accounts
- Email security (SPF, DKIM, DMARC)
- Backup and restore testing
- Incident response and 24-hour notification
- Policies and staff awareness
Frequently asked questions
Has SACS-210 replaced SACS-002?
Aramco's CCC page now names SACS-210 as the Third Party Cybersecurity Standard and does not mention SACS-002. In practice, new CCC assessments and renewals should be prepared against SACS-210.
Do all 149 controls apply to my company?
No. The 33 general controls apply to every third party. The specific controls apply according to your classification, such as Network Connectivity, Cloud Computing or Operational Technology. If you fall under several classifications, you must meet the controls for all of them.
Is my SACS-002 certificate still valid?
A CCC is valid for two years from issue. Aramco has not published a transition rule for SACS-002 certificates, so confirm with your Aramco proponent. Either way, plan your next renewal against SACS-210.
What are the OT requirements in SACS-210?
OT suppliers have extra controls, including OT awareness training and Secure-by-Design. Appendix D asks for IEC 62443 certification depending on the product or service type, for example 62443-4-2 for components such as PLCs and RTUs.
Does SACS-210 apply to our subcontractors?
Yes. The standard says the third party must ensure any subcontractors supporting the contracted work follow the applicable cybersecurity and data privacy requirements.
Where can I download SACS-210?
Aramco publishes the SACS-210 PDF and the 2026 Compliance Report Template on its Cybersecurity Compliance Certificate programme page. We can walk you through it in a short call.
See where you stand against SACS-210
Send us your classification and current setup. We will show you which SACS-210 requirements you already meet and what to fix first.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
