Aramco CCC or CCC+: Which One Your Company Needs

If you are seeking to register with Aramco, the requirement is to comply with all controls under the General Requirements section of the Third Party Cybersecurity Standard.

If you already hold an active procurement agreement, the process runs differently. You initiate a request to every Aramco proponent organisation your company has ongoing business with, asking each to complete the Third Party Classification Template. You then complete a Third Party Classification Confirmation Letter.

This is the step that surprises suppliers working across several parts of Aramco. Classification is assigned per relationship, and you are asking several organisations independently. The combined answer is frequently broader than a single contract would suggest.

Two rules govern the overlap, and both work in the direction of more scope rather than less.

First: where a company falls under more than one classification, all the cybersecurity controls under each determined classification are required. The classifications accumulate rather than replacing one another.

Second: where both CCC and CCC+ apply, only CCC+ is accepted.

A supplier that provides customized software to one Aramco organisation and network connectivity to another is therefore looking at a CCC+, assessed on site, against the controls of both classifications. Establishing this early changes the shape of the project. Establishing it late tends to change the timeline.

The certificate is issued where the company is fully compliant against all applicable requirements. Partial compliance does not produce a partial result: the Authorized Audit Firm returns the noncompliant controls, the company implements them, and the updated compliance report goes back for verification.

There is no partial pass to fall back on, which is the strongest practical argument for doing gap work before engaging an audit firm rather than treating the assessment as the discovery exercise.

Aramco is also specific about evidence, which is unusual and useful. Evidence must be clear, readable and time stamped, must show proof of its relation to the third party, and must be clearly highlighted within screenshots. Those are checkable criteria, and evidence that does not meet them creates avoidable findings regardless of whether the underlying control is sound.

The certificate is issued by an Authorized Audit Firm selected from the list Aramco publishes at aramco.com/ccc. A contract with that firm is established before assessment verification begins.

This is worth stating plainly because the market around Aramco compliance includes both audit firms and advisory firms, and they occupy different positions in the process. An advisory firm prepares you for the assessment. Only an Authorized Audit Firm verifies it and issues the certificate. A supplier benefits from understanding which one it is speaking to.

The issued certificate and the compliance report are submitted to Aramco through the e-marketplace System.

The certificate is valid for two years from the issuance date, and a new one must be submitted before that period ends. It can also expire in effect before then: if your company is awarded a contract involving a cybersecurity classification type the current certificate does not cover, a new certificate is required for that work.

For a growing supplier, that second condition matters more than the calendar. Winning a contract that adds a Network Connectivity or Critical Data Processor classification moves you to CCC+ and an on-site assessment, whatever your existing certificate says.

Aramco currently refers to its Third Party Cybersecurity Standard as SACS-210. The CCC Third Party Manual, dated July 2021, refers throughout to SACS-002, and both designations remain in circulation across supplier documentation and commentary.

For scoping purposes, confirm which designation and which control set your engagement is assessed against directly from Aramco's current supplier resources. Where a published figure or control count is quoted without a version, it is worth establishing which edition it describes before planning around it.

Classification first. It determines the certificate, the assessment approach, the control set, and consequently the effort. Every other decision follows from it, and it is the one question a supplier can answer without engaging anyone.

If you are preparing for a CCC or CCC+ assessment, our Aramco CCC readiness service covers classification review, gap assessment, control implementation and evidence preparation. For the broader question of which Saudi frameworks apply to your organisation, the NCA framework map works through the national controls, which are a separate matter from Aramco procurement.

Source: Saudi Aramco, Cybersecurity Compliance Certification (CCC) Third Party Manual, July 2021, and Aramco's supplier resources at aramco.com/ccc.