Understanding the applicable scope
The exact requirements depend on the supplier relationship, services, systems, data and official instructions provided for the assessment. Suppliers should confirm scope before investing in controls or documentation.
Common readiness areas
- Cybersecurity governance, policies, roles and risk management.
- Asset inventory, classification and secure configuration.
- Identity, privileged access and user lifecycle management.
- Endpoint, network, email and vulnerability protection.
- Logging, monitoring, incident response and recovery.
- Third-party controls, awareness, evidence ownership and review cycles.
Each requirement should be mapped to an implemented control, a responsible owner and current evidence. For implementation support, review the Aramco CCC service.
