Third Party Cybersecurity Compliance Certificate

Complete the following steps in order to obtain your Cybersecurity Compliance Certificate (CCC):

STEP 1: Certification Requirements Preparation

• 1.1. In order for a Third Party to obtain a CCC certificate, the Third Party is required to register in the Supplier Registration Portal through Aramco’s e-Marketplace system 
• 1.2. Initiate a request with the department/proponent(s) from Aramco, or other Aramco Group company, that your company is conducting business with, to complete the Third Party Classification Template
  
  
• 1.3. Once the Third Party Classification Template is received, the Third Party must fill out and sign the Third Party Classification Confirmation Letter
  
  • 1.3.1. Implement all applicable cybersecurity controls specified in the Third Party Cybersecurity Standard (SACS-210)
  • 1.3.2. If the company falls under more than one classification, then all the cybersecurity controls under the relevant/applicable classifications are required

STEP 2: Select an Authorized Audit Firm

• 2.1. Visit the CCC Portal and complete the Third Party registration
  
  
• 2.2. Submit a CCC request to one of the Authorized Audit Firms (see list below)

STEP 3: Compliance Verification & Issuance

• 3.1. CCC assessment process:
• 3.1.1. Conduct the CCC compliance assessment
  
  • Fill out all of the fields in the Third Party Cybersecurity Compliance Report 
  • Ensure the answers are comprehensive and clearly described, and attach all the required supporting documents 
  • Ensure that all the evidence provided is recent, clear, and time stamped, and that proof of its relation to the Third Party is clearly pointed out/highlighted in the screenshots

• 3.1.2. The selected Authorized Audit Firm will verify the documents and generate the Third Party Cybersecurity Compliance Report

• 3.2. CCC/CCC+ assessment process:

• 3.2.1. Submit the completed documents
  • Third Party Classification Template
  • Third-Party Classification Confirmation Letter to the Authorized Audit Firm, prior to the assessment verification

• 3.2.2. Arrange with the selected Authorized Audit Firm to conduct the compliance assessment in accordance with the applicable certificate type and the assessment requirements stated above
• 3.2.3. The Authorized Audit Firm will conduct the assessment, generate the Cybersecurity Compliance Report and issue the certificate

STEP 4: Submit the Issued Certificate

• 4.1. Submit the issued certificate and Compliance Report from the Authorized Audit Firm to Aramco, through the e-Marketplace system

STEP 5: CCC Validity & Renewal

• 5.1. The CCC will be accepted by Aramco, Sabic, and other Aramco Group companies 
• 5.2. The CCC is valid for two years from the issuance date
• 5.2.1. If the company is awarded a new contract that involves a cybersecurity classification type not covered in the current valid certificate, then a new certificate needs to be obtained and submitted
• 5.2.2. Prior to the end of the two years, your company needs to renew its CCC