Saudi Aramco SACS-002 — Third Party Cybersecurity Standard
- ClassificationCategorySupply Chain SecurityDomainCybersecurityFramework FamilyOther
- Regulatory ContextTypeStandardLegal InstrumentStandardSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionMiddle EastRegion DetailSaudi ArabiaPublisherSaudi Aramco (Information Security Department)
- VersioningVersionSACS-002, issue date February 2022Effective DateFebruary 2022Issue DateFebruary 2022
- AdoptionAdoption ModelIndustry RequirementImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
SACS-002 is published by Saudi Aramco and is publicly available from the Aramco supplier resources site.
Framework text is licensed by its publisher and is included only where stated above.
Overview
Saudi Aramco SACS-002 — Third Party Cybersecurity Standard sets the cybersecurity requirements that Saudi Aramco's suppliers, contractors, and service providers must meet. Its purpose is to protect Aramco's data, networks, and operations from risks introduced through third parties.
Issued by Saudi Aramco's Information Security Department (issue date February 2022), SACS-002 applies to any third party that does business with Aramco. The controls that apply depend on the third party's classification: general requirements for all vendors, and additional requirements for outsourced infrastructure, customized software, network connectivity, and critical data processors. Compliance is verified through Aramco's Cybersecurity Compliance Certificate program: a CCC, based on a self-assessment verified remotely by an Aramco-authorized audit firm, or a CCC+, which requires an on-site assessment; certificates are valid for two years.
Third parties implement SACS-002 by determining their classification, assessing their controls against the applicable requirements, closing the gaps the authorized audit firm reports, and renewing the certificate before it expires. The standard draws on ISO/IEC 27001 and the NCA's Essential Cybersecurity Controls, so organizations already aligned to those map their existing controls to it.
Why it Matters
SACS-002 is the cybersecurity standard Saudi Aramco imposes on its suppliers, and the Cybersecurity Compliance Certificate (CCC) built on it is a condition of doing business.
Key benefits include:
- Keep supplier status with Aramco
Registration and continued business require a valid CCC or CCC+, so the standard directly affects revenue.
- Know which controls apply
Requirements depend on the third party's classification: general requirements for everyone, more for outsourced infrastructure, customized software, network connectivity and critical data processing.
- Prepare for the audit firm
Compliance is verified by an Aramco-authorized audit firm, remotely for CCC and on site for CCC+.
- Reuse existing programs
The controls overlap with ISO/IEC 27001, the NCA Essential Cybersecurity Controls and CIS Controls, so existing evidence counts.
- Plan for renewal
Certificates expire and must be renewed, so the program needs owners and a calendar rather than a one-time project.
How it Works
SACS-002 sets cybersecurity controls in sections that follow the third party's classification. Section A, general requirements, applies to every supplier: governance, asset management, access control, awareness, email and endpoint protection, vulnerability management, backup and incident handling. Further sections add controls for suppliers that host outsourced infrastructure, develop customized software for Aramco, connect to Aramco networks or process its critical data.
A supplier determines its classification with the Aramco organizations it serves, performs a self-assessment against the applicable sections, and engages an authorized audit firm. General, outsourced-infrastructure and customized-software classifications receive the CCC after remote verification; network-connectivity and critical-data-processor classifications receive the CCC+ after an on-site assessment. The certificate and the audit report are submitted through Aramco's supplier system and renewed before expiry.
In SmartSuite, each SACS-002 control is a record with the classification it belongs to, an owner, implementation status and evidence. The self-assessment, audit findings, remediation and the certificate's expiry date are tracked so renewal is never missed.
Key Elements
Third-party classification
General requirements, outsourced infrastructure, customized software, network connectivity and critical data processor; all applicable classifications apply.
General requirements (Section A)
The baseline every supplier must meet to register and trade with Aramco.
Classification-specific controls
Additional controls for hosting, development, connectivity and critical data, including secure development and network segregation.
Self-assessment
The supplier's own assessment against SACS-002 that the audit firm verifies.
CCC and CCC+
The Cybersecurity Compliance Certificate issued after remote verification, or CCC+ after an on-site assessment.
Authorized audit firms
Firms approved by Aramco to verify compliance and issue the certificate report.
Renewal
Certificates have a fixed validity and must be renewed with a new assessment.
Framework Scope
SACS-002 applies to every third party that does business with Saudi Aramco: suppliers, contractors, consultants and service providers in Saudi Arabia and abroad. The controls that apply are determined by the supplier's classification, and the standard governs the supplier's own systems, people and subcontractors that touch Aramco data, networks or deliverables.
Framework Objectives
SACS-002 exists to reduce the risk that reaches Saudi Aramco through its supply chain.
Set a cybersecurity baseline that every supplier must meet.
Scale requirements to the access and data each supplier has.
Verify compliance independently through authorized audit firms.
Make certificate status a visible condition of procurement.
Keep supplier security current through periodic renewal.
Framework in Context
SACS-002 is a supplier security standard like the Shared Assessments SIG or NIST SP 800-161 supply-chain guidance, applied by a single buyer. Its controls align with ISO/IEC 27001:2022 and ISO/IEC 27036 supplier-relationship security, with the NCA Essential Cybersecurity Controls that many Saudi suppliers already follow, and with CIS Controls v8.1.
Common Framework Mappings
Suppliers map SACS-002 to the standards they already hold so that one control set produces evidence for Aramco, the NCA and international customers.
Mapped frameworks include:
ISO 27001:2022
ISO/IEC 27036
NCA ECC-1:2018
CIS Controls v8.1
NIST CSF 2.0
NIST 800-53 Rev.5
NIST SP 800-161 Rev.1
How SmartSuite Supports SACS-002
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Manage SACS-002 by holding each control under its classification with an owner and evidence, running the self-assessment, tracking audit findings and renewing the CCC or CCC+ before it expires.
SACS-002 Control Library by Classification
Structure the general requirements and the classification-specific controls with owners and implementation status.
Third-Party Classification Record
Record the classifications agreed with each Aramco organization and the controls they bring into scope.
Self-Assessment and Evidence
Complete the self-assessment against SACS-002 and attach the evidence the audit firm will verify.
Audit Findings and Remediation
Track findings from the authorized audit firm, corrective actions, owners and closure.
Subcontractor and Connectivity Controls
Monitor subcontractors and network connections that fall under the critical data and connectivity classifications.
CCC Status and Renewal Reporting
Report certificate status, expiry dates, open findings and readiness for the next assessment.
Related frameworks
ISO/IEC 27001:2022 is an international ISMS standard that helps organizations manage information security risks and protect data.
ISO/IEC 27036 is the four-part international standard for information security in supplier relationships, covering concepts, requirements, ICT supply chain security, and cloud services.
Saudi Arabia's ECC-1:2018 defines essential cybersecurity controls to help organizations protect information systems and sensitive data.
CIS Controls v8.1 provides prioritized, practical security actions to help organizations mitigate common cyber threats and strengthen defenses.
NIST Cybersecurity Framework (CSF) v2.0 is a risk-based framework that helps organizations manage and reduce cybersecurity risks.
Frequently Asked Questions For Saudi Aramco SACS-002 (Third Party Cybersecurity Standard)
SACS-002 is Saudi Aramco's Third Party Cybersecurity Standard. It sets the cybersecurity controls that suppliers, contractors and service providers must meet to protect Aramco's data, networks and operations, and it is the basis of the Cybersecurity Compliance Certificate (CCC) program.
Yes, for any third party that does business with Saudi Aramco. New suppliers must meet the general requirements to register, and existing suppliers must hold a valid CCC or CCC+ for their classification to keep trading.
Saudi Aramco's Information Security Department issued the standard; the current issue is dated February 2022. It is not a National Cybersecurity Authority standard, although its controls align with the NCA Essential Cybersecurity Controls.
General requirements, outsourced infrastructure, customized software, network connectivity and critical data processor. The classifications a supplier falls under are agreed with the Aramco organizations it serves, and all applicable controls apply.
The CCC covers the general, outsourced-infrastructure and customized-software classifications and is issued after a self-assessment verified remotely by an authorized audit firm. The CCC+ covers network connectivity and critical data processors and requires an on-site assessment; where both could apply, only CCC+ is accepted.
Audit firms authorized by Saudi Aramco. The supplier completes a self-assessment, the audit firm verifies it remotely or on site, and the certificate and report are submitted through Aramco's supplier system.
Certificates have a fixed validity set out in Aramco's third-party manual and must be renewed with a new assessment before they expire. Suppliers should track the expiry date and start the renewal early.
SmartSuite holds the SACS-002 controls under each classification with owners and evidence, runs the self-assessment, tracks audit findings and remediation, and reports certificate status and renewal dates.
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.