Aramco CCC vs. CCC+: What Is the Difference?

Saudi Aramco established its Third-Party Cybersecurity Compliance Program to verify that suppliers and contractors implement the cybersecurity controls applicable to their operations.

Both CCC and CCC+ are assessed against SACS-210, Saudi Aramco's Third-Party Cybersecurity Standard, updated in February 2026.

The main distinction is how compliance is verified:

• Aramco CCC: The supplier completes a cybersecurity self-assessment, which an Aramco-authorized audit firm verifies remotely.
• Aramco CCC+: An Aramco-authorized audit firm conducts an on-site cybersecurity compliance assessment.

The applicable certificate depends on the supplier's official cybersecurity classification, not simply the company's size or industry.

The following comparison summarizes the main differences between the two certification approaches.

Saudi Aramco determines cybersecurity requirements through its Third Party Classification process.

The February 2026 SACS-210 standard identifies classifications including:

• General Requirement: Baseline cybersecurity controls applicable to third parties.
• Network Connectivity: Suppliers with network connectivity to Aramco systems.
• Outsourced & Managed Services: Companies managing or supporting outsourced infrastructure and services.
• Critical Data Processor: Suppliers accessing or processing sensitive company data.
• Customized Software: Providers developing or hosting customized software and applications.
• Cloud Computing: Providers delivering cloud infrastructure, platforms, or software services.
• Operational Technology: Suppliers working with industrial control systems and related technologies.

According to Aramco's certification FAQ, Network Connectivity and Critical Data Processor classifications require CCC+, while other classifications generally follow the CCC assessment route. The classification table on the same Aramco page lists Network Connectivity under CCC, so suppliers in that classification in particular should confirm which certificate applies.

In every case, suppliers must confirm the applicable certificate type with their Aramco proponent and authorized audit firm.

What If Multiple Classifications Apply?

A supplier may fall under more than one cybersecurity classification.

For example, an IT contractor could provide managed services while also processing confidential information.

In such cases, the organization must implement the cybersecurity controls applicable to all relevant classifications. Where CCC+ is required, the assessment must cover the applicable scope.

Regardless of certification type, preparation begins with understanding the applicable SACS-210 requirements. Our Aramco CCC requirements checklist covers each preparation step in more detail.

Step 1: Confirm Your Classification

Coordinate with the relevant Aramco department or proponent to complete the Third Party Classification Template.

Prepare the Classification Confirmation Letter and identify the applicable controls.

Step 2: Conduct a Cybersecurity Gap Assessment

Review existing cybersecurity practices against the applicable SACS-210 requirements.

Key areas may include:

• Cybersecurity governance and policies
• Asset management and access control
• Multi-factor authentication
• Endpoint and network protection
• Data protection and encryption
• Vulnerability and patch management
• Security monitoring and incident response

Additional controls depend on the supplier's classification.

Step 3: Prepare Documentation and Evidence

Organize the cybersecurity documentation required to demonstrate compliance.

Supporting evidence may include approved policies, asset inventories, security configurations, access reviews, monitoring records, and employee awareness records.

Evidence should be clear, current, time-stamped, and identifiable as belonging to the supplier.

Step 4: Address Compliance Gaps

Implement corrective actions for missing controls or incomplete evidence before the formal assessment.

An internal readiness review can help identify potential findings and reduce unnecessary delays.

Step 5: Complete the Authorized Assessment

Select an Aramco-authorized audit firm through the official CCC Portal.

For CCC, submit the completed self-assessment and supporting evidence for remote verification.

For CCC+, coordinate the required on-site assessment with the authorized audit firm.

Following successful verification and certificate issuance, submit the certificate and compliance report through Aramco's e-Marketplace system, the same platform used for supplier registration with Saudi Aramco.

Saudi Aramco's CCC certification is generally valid for two years from the issuance date, provided the supplier's cybersecurity classification remains unchanged.

Suppliers should maintain their cybersecurity controls and supporting evidence throughout the certification period.

If a new contract introduces a cybersecurity classification not covered by the existing certificate, an additional assessment and updated certification may be required.

Preparing for renewal before expiry helps avoid interruptions to compliance status.

Understanding the differences between Aramco CCC and CCC+ is essential for suppliers preparing to meet Saudi Aramco's cybersecurity requirements.

Nour Solutions supports contractors, vendors, and service providers across Saudi Arabia, including Al Khobar, Dammam, Dhahran, Jubail, and Riyadh.

Our cybersecurity consultancy services include SACS-210 gap assessments, compliance documentation, technical remediation guidance, and audit readiness support.

Explore our Aramco CCC & CCC+ Compliance Services to learn how we can help your organization prepare for the applicable certification assessment.

• Saudi Aramco — Third-Party Cybersecurity Compliance Certificate Program — Certificate types, classification and the assessment process.
• SACS-210 Third-Party Cybersecurity Standard (February 2026) — The full standard, as a PDF download.