Aramco SACS-210 (2026): What Has Changed for Third Parties?

Saudi Aramco’s cybersecurity standard SACS-210  has long established the cybersecurity baseline for every third party seeking to engage with the world’s largest oil and gas company. The 2026 revision signals a decisive shift from documentation-led compliance toward demonstrated, auditable security capability across the entire supplier ecosystem.

The scale of Saudi Aramco’s operations means that its supply chain encompasses thousands of vendors, contractors, and technology providers operating across IT, operational technology (OT), and industrial control system (ICS) environments. Each of these relationships represents a potential point of exposure. Aramco’s sustained investment in strengthening SACS-210 reflects an industry-wide recognition that perimeter-based security is insufficient; resilience depends on the integrity of every partner in the chain. For CISOs, compliance officers, and procurement leaders at third-party organisations, understanding the 2026 changes is not optional it is a prerequisite for continued commercial access to one of the most significant energy operators in the world.

This blog provides a structured analysis of the 2026 SACS-210 updates, their practical implications for third parties, and the relationship between this standard and adjacent frameworks including SABIC’s Cybersecurity Compliance Certification. Whether your organisation is approaching its first assessment or renewing existing compliance status, this guide offers the clarity needed to navigate the updated requirements with confidence.

What the 2026 SACS-210 Standard Means for Third Parties.?

Saudi Aramco cybersecurity standard has consistently updated SACS-210 to reflect the evolving threat landscape facing critical national infrastructure. The 2026 revision is the most substantive update in several years, driven by the increasing sophistication of supply chain attacks and the accelerating convergence of IT and OT systems within energy operations. Where previous iterations focused primarily on establishing documented policies and procedural controls, the 2026 standard places greater emphasis on demonstrable technical implementation and ongoing assurance.

Expanded Scope of Controls

The updated standard broadens the control domains third parties must address. Identity and access management now requires more granular privilege controls, with particular scrutiny on privileged access to OT environments. Incident response capabilities must be documented and, in higher-risk vendor categories, tested. Vulnerability management obligations extend more explicitly to industrial control systems and embedded devices areas that were often treated as peripheral under earlier versions of the standard.

Assessment Methodology Changes

One of the most consequential shifts in the 2026 update concerns how compliance is assessed. Aramco has moved toward a tiered assessment model that classifies third parties by risk level based on factors such as the sensitivity of data accessed, the criticality of systems managed, and the nature of network connectivity. Higher-tier vendors face more rigorous scrutiny, including technical verification rather than documentary review alone. For organisations accustomed to meeting earlier iterations through policy submissions and self-attestation, this represents a significant operational adjustment.
SACS-210 assigns requirements according to third-party classification. Under Aramco’s CCC programme, CCC uses self-assessment with remote verification, while CCC+ requires an on-site assessment for the specified classifications. The 2026 standard also introduces that Third parties should address assessment findings promptly and maintain compliance with applicable controls.

Aramco Third Party Cybersecurity: What Vendors Must Now Demonstrate

The practical burden on third parties has increased materially. Organisations entering or renewing their approved vendor status must now provide evidence of implemented controls rather than policy documents alone. This shift requires a level of security programme maturity that many smaller suppliers have not previously needed to articulate formally. For compliance officers preparing their organisations for assessment, understanding the control domains most affected by the 2026 changes is paramount.

Identity and Access Management

Access governance has emerged as a focal point in the updated standard. Third parties must demonstrate least-privilege access controls for personnel with access to Aramco environments. Further, MFA is required for the applicable access scenarios specified in SACS-210, and user accounts and access rights must be reviewed at least annually Privileged access must be managed through formal processes, with session logging and periodic access reviews forming part of the expected control set. These requirements are not conceptually new, but the 2026 standard demands evidence of their operational implementation rather than their theoretical existence in a policy document.

Incident Response and Reporting Obligations

The 2026 revision introduces more prescriptive incident response requirements. Third parties must maintain a documented incident response plan that addresses scenarios relevant to their Aramco engagement. Critically, notification timelines to Aramco in the event of a suspected or confirmed breach have been tightened. Organisations that lack a tested and operationally current incident response capability will need to invest in both the plan and the exercise regime to satisfy the updated requirements.

OT and ICS Security

For vendors with connectivity to or management responsibility over operational technology assets, the 2026 standard extends specific obligations around network segmentation, secure remote access to industrial systems, and hardening of connected devices. This reflects the heightened risk profile of OT environments and Aramco’s recognition that legacy industrial systems, when connected to wider networks without adequate controls, represent a material attack surface.

SACS-210 2026 and Its Relationship to SABIC CCC

Saudi Arabia’s two largest energy and petrochemical enterprises have independently developed cybersecurity compliance programmes for their supplier ecosystems. While SACS-210 governs third parties engaging with Saudi Aramco, SABIC’s CCC programme applies to suppliers within SABIC’s supply chain. The two frameworks share common lineage in international standards such as IEC 62443 and ISO/IEC 27001, which creates meaningful overlap in control requirements.

Where the Frameworks Align

Both programmes require third parties to establish formal information security management practices, govern access to industrial and corporate systems, maintain incident response capabilities, and demonstrate ongoing compliance through periodic reassessment. For an organisation already certified or assessed under one framework, a substantial proportion of the required controls will map across to the other. This alignment is advantageous for suppliers serving both entities, as it reduces the total compliance burden when programmes are managed in an integrated fashion.

Where Distinctions Remain

Despite their structural similarities, SACS-210 and SABIC CCC are not interchangeable. Each framework contains requirements specific to its respective organisation’s infrastructure, risk appetite, and assessment methodology. SACS-210’s 2026 update introduces third-party classifications and corresponding applicable controls that do not have a direct equivalent in SABIC CCC as currently structured. Organisations should therefore treat compliance with each standard as a distinct programme, while leveraging shared control investments wherever the frameworks converge.

For suppliers navigating both programmes simultaneously, the most effective approach is to establish a unified control framework anchored in a recognised international standard and then map each organisation’s specific requirements as overlays. This architecture supports high performance across both compliance programmes without duplicating effort unnecessarily.

Aramco Cybersecurity Requirements: Practical Implications for Compliance Officers

The 2026 changes represent a maturation of Aramco’s supplier assurance programme, and they demand a corresponding maturation in how third parties manage their own cybersecurity governance. Compliance officers who have historically managed SACS-210 as a documentation exercise must now reframe it as a continuous operational discipline. The standard’s enforcement posture makes this reframing commercially necessary.

Building a Sustainable Compliance Programme

Organisations that approach SACS-210 compliance as a point-in-time assessment will find themselves repeatedly confronted with remediation demands and the operational disruption that accompanies them. A more resilient approach is to embed compliance activities into routine security operations: continuous vulnerability management, regular access reviews, periodic incident response exercises, and documented change management processes. This operational integration ensures that compliance status reflects actual security posture rather than a snapshot prepared for assessment.

Engaging Internal Stakeholders

SACS-210 compliance is not exclusively a cybersecurity team responsibility. Procurement, legal, and senior leadership must understand the commercial stakes of non-compliance and the resource commitments required to maintain approved vendor status. CISOs and compliance officers play a critical role in translating technical obligations into business terms, securing the organisational investment necessary to sustain a compliant security programme over time.

The 2026 update also underscores the importance of third-party management within a vendor’s own supply chain. Aramco cybersecurity requirements expect its direct suppliers to exercise appropriate oversight of their subcontractors where those subcontractors have access to Aramco-related data or systems. This creates a cascading compliance obligation that compliance officers must account for in their programme design.

Conclusion

The 2026 revision of Aramco SACS-210 marks a significant inflection point in how Saudi Aramco governs cybersecurity across its supply chain. By shifting toward demonstrable, auditable controls and introducing a tiered assessment model with defined enforcement consequences, Aramco has signalled that third-party cybersecurity resilience is a strategic commercial requirement not a compliance formality. For vendors and contractors operating within this ecosystem, the path forward demands a genuine elevation of security programme maturity, supported by the governance structures, technical investments, and internal stakeholder alignment necessary to sustain compliance over time.

Organisations that act now assessing their current posture against the 2026 requirements, identifying gaps, and building remediation roadmaps will be better positioned to maintain approved vendor status and protect their commercial relationships with one of the world’s most consequential energy enterprises.  Organisations serving both Saudi Aramco and SABIC face convergent requirements under SACS-210 and the SABIC CCC programme, making an integrated compliance framework anchored in standards such as ISO/IEC 27001 and IEC 62443 the most operationally efficient path to sustained adherence. ValueMentor’s cybersecurity compliance specialists work alongside your team as a trusted partner mapping your existing controls, identifying gaps, and building a remediation roadmap that positions you for long-term approved vendor status. Visit us to learn how we can support your compliance programme and help your organisation succeed within Aramco’s evolving supplier ecosystem.

FAQs