What Is SAMA CSF? The Saudi Central Bank Cybersecurity Framework
SAMA CSF explained: who must comply, the four domains, the six-level maturity model, how assessment works, and which requirements infrastructure can satisfy.
Read MoreSaudi & GCC Compliance
Aramco CCC, SACS-002 and GCC cybersecurity certification requirements for third-party vendors. 23 articles from the MassiveGRID engineering teams.
SAMA CSF Compliance Checklist for Hosting and Infrastructure
A SAMA CSF checklist for infrastructure: access, cryptography, logging, resilience, vulnerability and third-party controls, with the evidence each one needs.
Read MoreNCA ECC Explained: Saudi Essential Cybersecurity Controls
NCA ECC explained: the five domains, the CCC, CSCC and DCC overlays, who is in scope, how it differs from SAMA CSF, and what an assessment looks for.
Read MoreSaudi PDPL and Data Residency: What Must Stay in the Kingdom
Saudi PDPL data residency: what the 2023 amendments changed on transfers, how to classify data, the questions to ask a provider, and where sector rules bite.
Read MoreData Residency Across the GCC: Country by Country
GCC data residency country by country: the six instruments and regulators, three transfer postures, the DIFC and ADGM free zones, and a method that scales.
Read MoreAcceptable Use Policy for Aramco CCC -- TPC-1 Requirements and Template Guide
TPC-1 is the very first control in the SACS-002 standard, and for good reason: it establishes the governance foundation that every other control builds upon.
Read MoreHow to Prepare for Your Aramco CCC Audit -- What to Expect from the Assessment
How to Prepare for Your Aramco CCC Audit -- What to Expect from the Assessment: Who Conducts the Audit and CCC vs CCC+ Assessment: What is Different.
Read MoreBackup and Disaster Recovery for Aramco CCC Compliance -- Business Continuity Requirements
Backup and Disaster Recovery for Aramco CCC Compliance -- Business Continuity Requirements: SACS-002 Backup and Disaster Recovery Requirements Overview.
Read MoreData Classification Policy for Aramco CCC -- TPC-9 Requirements and Template Guide
Data Classification Policy for Aramco CCC -- TPC-9 Requirements and Template Guide: What the SACS-002 Standard Requires.
Read MoreAramco CCC Email Security Requirements -- SPF, DKIM, and Private Domains
Aramco CCC Email Security Requirements -- SPF, DKIM, and Private Domains: The SACS-002 Email Controls at a Glance and Email TPC Control Mapping.
Read MoreFile Hosting and Data Security for Aramco Third-Party Compliance
Every Aramco third-party vendor handles some form of data that belongs to or relates to Aramco. Covers Data Classification: The Foundation of File Security.
Read MoreFirewall and Endpoint Protection for Aramco CCC Compliance
Firewall and Endpoint Protection for Aramco CCC Compliance: TPC-6: The Protective Technology Mandate and Firewall Requirements.
Read MoreIdentity and Access Lifecycle Management for Aramco CCC -- TPC-6 and TPC-18 Compliance
When an employee leaves your organization, how long does it take to revoke their access to every system that touches Aramco data?
Read MoreIncident Response Plan for Aramco CCC -- TPC-23 and the 24-Hour Notification Requirement
Incident Response Plan for Aramco CCC -- TPC-23 and the 24-Hour Notification Requirement: What TPC-23 Requires and What Counts as an Incident.
Read MoreAramco CCC Patch Management Requirements -- TPC-11 Compliance Guide
Aramco CCC Patch Management Requirements -- TPC-11 Compliance Guide: What TPC-11 Requires: The Core Obligation and Patching Frequency and SLA Expectations.
Read MoreHow to Renew Your Aramco CCC Before It Expires
How to Renew Your Aramco CCC Before It Expires: The Renewal Process, Renewal Timeline: When to Start and Classification Change Scenarios.
Read MoreSecure Remote Access for Aramco Vendors — VPN and Remote Desktop Compliance
If your organization is an Aramco third-party vendor with distributed teams, remote access to systems handling Aramco data is a daily operational necessity.
Read MoreSecurity Awareness Training for Aramco CCC Compliance -- TPC-7 Requirements
Security Awareness Training for Aramco CCC Compliance -- TPC-7 Requirements: What TPC-7 Requires and Required Training Topics.
Read MoreCCC vs CCC+ — Which Aramco Cybersecurity Certificate Do You Need?
CCC vs CCC+: The Five Vendor Classifications, Which Classification Needs Which Certificate and CCC vs CCC+: Key Differences.
Read MoreAccess Control and MFA -- Meeting SACS-002 Authentication Requirements
Access Control and MFA -- Meeting SACS-002 Authentication Requirements: TPC-2: Password Policy Requirements and Password Policy Requirements Table.
Read MoreSACS-002 Audit Preparation — Gathering Evidence for Your CCC Assessment
SACS-002 Audit Preparation: Understanding the Evidence Standard, Email Controls: TPC-8, TPC-9, TPC-10 and Access Controls: TPC-2, TPC-3.
Read MoreSACS-002 Encryption Requirements -- Protecting Data in Transit and at Rest
Encryption is not a nice-to-have in the Aramco CCC framework -- it is a hard requirement with specific protocols named in the standard.
Read MoreWhat Is Aramco CCC and Why Does Your Business Need It?
What Is Aramco CCC and Why Does Your Business Need It: The Origin of Aramco CCC: Why It Exists and CCC vs. CCC+: Two Tiers of Certification.
Read More