Achieve Aramco
CCC & CCC+
Infrastructure built to satisfy SACS-002 Third Party Cybersecurity Standard controls. MassiveGRID provides the encrypted, monitored, and hardened cloud environment Aramco suppliers need to obtain and maintain their Cybersecurity Compliance Certificate.
Framework & Standard Alignment
CCC vs. CCC+ — Which Do You Need?
Saudi Aramco classifies third-party suppliers into categories that determine which certificate level is required. Your classification depends on the nature of your engagement with Aramco.
| Classification | Description | Certificate |
|---|---|---|
| General Requirement | Any supplier engaged in business with Aramco (trading, services) | CCC |
| Outsourced Infrastructure | Suppliers supporting infrastructure management, maintenance, or business processes | CCC |
| Customized Software | Suppliers providing custom-built software, ERP systems, or web applications | CCC |
| Cloud Computing Service | IaaS, PaaS, or SaaS providers hosting Aramco-related workloads | CCC |
| Network Connectivity | Suppliers with direct network connectivity to Aramco via VPN or leased lines | CCC+ |
| Critical Data Processor | Suppliers processing Aramco data (accounting, risk, sensitive operations) | CCC+ |
CCC requires self-assessment validated remotely by an authorized audit firm. CCC+ requires an on-site assessment. Both are valid for 2 years. If both apply, only CCC+ is required.
SACS-002 mandates strict access control policies, multi-factor authentication, encryption in transit, and data partitioning. MassiveGRID's infrastructure delivers these controls at the platform level, reducing the compliance burden on your team.
Multi-Factor Authentication
MFA enforced on all management interfaces, control panels, and remote access sessions. SACS-002 requires MFA for remote access and cloud services — MassiveGRID enables this by default.
Encryption in Transit
All data transmitted to and from MassiveGRID infrastructure is encrypted using TLS 1.3, SSH, HTTPS, and IPSEC. SACS-002 explicitly requires encryption protocols for data in transit.
Data Partitioning & Isolation
Aramco data must be logically partitioned from other tenants, including in cloud environments. MassiveGRID provides dedicated VPS and private cloud options with full tenant isolation at the hypervisor level.
Role-Based Access Control
RBAC policies enforced across all infrastructure. SACS-002 requires password policies (8+ characters, 90-day rotation, 12-password history) and account lockout after 10 failed attempts — all configurable on our platform.
Encryption at Rest
AES-256 full-disk encryption on all storage volumes. SACS-002 requires data protection for sensitive information — MassiveGRID encrypts data at rest by default with customer-managed key options.
Email Security & SPF
SACS-002 mandates SPF email security and private email domains. MassiveGRID hosting includes SPF, DKIM, and DMARC configuration support — no Gmail or consumer email providers allowed per the standard.
SACS-002 requires firewall protection on all endpoints, DDoS mitigation, intrusion detection, anti-virus with daily updates, and WPA2/WPA2-Enterprise for wireless networks. MassiveGRID's infrastructure satisfies these controls at the network and platform layers.
DDoS Protection
Enterprise-grade DDoS mitigation with 10+ Tbps scrubbing capacity across all data centers. SACS-002 explicitly requires DDoS protection — it is included on every MassiveGRID deployment at no extra cost.
Firewall & Network Segmentation
Host-based and network-level firewalls with subnet segmentation. SACS-002 requires firewalls on all endpoints and network segmentation to limit lateral movement — built into MassiveGRID's architecture.
IDS/IPS & Threat Detection
Intrusion Detection and Prevention Systems monitor all network traffic for malicious activity. Managed cloud and dedicated plans include proactive threat detection aligned with SACS-002 anomaly monitoring requirements.
Anti-Virus & Endpoint Protection
SACS-002 requires anti-virus with daily definition updates and full system scans every 2 weeks. Managed plans include endpoint protection with automated scanning and update schedules that satisfy these controls.
SACS-002 requires audit logging with 1-year retention, continuous security monitoring, and incident notification to Aramco within 24 hours. MassiveGRID's monitoring stack and incident response procedures align directly with these requirements.
Audit Logging & Retention
Comprehensive audit logs capturing authentication events, access changes, and system modifications. SACS-002 mandates log retention for at least 1 year — MassiveGRID retains logs with tamper-evident storage.
24/7 Security Monitoring
Round-the-clock monitoring by MassiveGRID's security operations team. SACS-002 requires continuous monitoring and security scanning — our NOC/SOC provides real-time alerting and escalation.
Incident Response & Notification
Structured incident response process aligned with SACS-002 Appendix A requirements. Aramco must be notified within 24 hours of a security incident, with full technical reports delivered within 10 business days.
Penetration Testing Support
SACS-002 requires annual external penetration testing on IT infrastructure. MassiveGRID supports customer-initiated pen testing with pre-authorized testing windows and infrastructure access coordination.
Beyond technical controls, SACS-002 requires organizational governance: dedicated cybersecurity personnel, cybersecurity policies, annual training, disaster recovery planning, and asset classification. MassiveGRID helps you meet these requirements at the infrastructure level.
Disaster Recovery & Business Continuity
SACS-002 requires documented disaster recovery and business continuity plans. MassiveGRID's HA cluster architecture, automated failover, and geographic redundancy provide the infrastructure foundation for your DR/BCP strategy.
- Proxmox HA cluster with automatic VM failover
- Geographic redundancy across 4 datacenter regions
- Automated daily backups with configurable retention
- RPO and RTO aligned with your business requirements
- DR testing support and documentation assistance
Cybersecurity Training & Personnel
SACS-002 mandates annual cybersecurity training covering phishing, social engineering, data security, and acceptable use. Dedicated cybersecurity personnel must be appointed whose primary responsibility is security.
- MassiveGRID support team trained on SACS-002 controls
- Customer-facing security documentation and best practices
- Guidance on training program requirements for your organization
- Security policy templates aligned with SACS-002 governance requirements
- Assistance with asset classification and information labeling
Network Connectivity Security
For suppliers requiring direct network connectivity to Aramco (CCC+ classification), MassiveGRID provides the secure network infrastructure needed for VPN tunnels and leased line termination points.
- IPSEC VPN with AES-256 encryption for Aramco connectivity
- WPA2/WPA2-Enterprise wireless security compliance
- Private VLAN and subnet isolation per SACS-002
- Dedicated private cloud with no shared network paths
- Network access control (NAC) and 802.1X support
Media Sanitization & Data Handling
SACS-002 requires secure media sanitization procedures when hardware is decommissioned or repurposed. MassiveGRID follows NIST 800-88 guidelines for media sanitization and provides certificates of destruction.
- Cryptographic erasure on storage decommission
- NIST 800-88 compliant media sanitization
- Certificates of destruction available on request
- Secure data handling procedures throughout lifecycle
- Physical media destruction for highest-sensitivity workloads
Your Path to CCC/CCC+ Certification
MassiveGRID accelerates your compliance journey by providing infrastructure that satisfies the technical controls in SACS-002 out of the box. Here is the typical certification process.
Ready to Achieve Aramco CCC Compliance?
MassiveGRID's compliance team works directly with Aramco suppliers and authorized audit firms. Contact us to discuss your classification, control requirements, and deployment strategy.