Saudi Arabia - SACS-002 Third Party Cybersecurity Standard (2022)

SACS-002, the Saudi Aramco Third Party Cybersecurity Standard, is a contractual security standard issued by Saudi Aramco in 2022. It sets baseline cybersecurity requirements for third parties, including suppliers, contractors and service providers, that connect to Saudi Aramco networks, handle its data, or provide products and services that could affect its operations. It is a mandatory condition of doing business with Saudi Aramco rather than a government law.

The standard organises requirements into control profiles that scale with the nature of the engagement, covering areas such as governance, data protection, connectivity and, where relevant, the security of manufactured or connected products and industrial control environments. Third parties are expected to demonstrate compliance, often through self-assessment and independent certification, before and during their contractual relationship.