Cybersecurity Compliance Certificate

Purpose

(Cybersecurity Compliance Certificate)Third Party Cybersecurity Standard (TPCS) sets forth the minimum Cybersecurity requirements for Saudi Aramco Third Parties to protect Saudi Aramco from possible cyber threats and strengthen Third Parties’ security posture.

Scope

This Standard applies to All Third Parties engaging with Saudi Aramco through contractual agreements.

Ready to start compliance process ?!

Our engineers will be happy to serve you , to ensuring you achieve highest standards of cybersecurity compliance for your organization

The standard consists of four major components:

Identify Third Party Cybersecurity Controls For Cybersecurity Compliance Certificate

The identification component consists of four parts:

Governance

Third Party must establish, maintain and communicate a Cybersecurity Acceptable Use Policy (AUP) governing the use of Third Party Technology Assets.

Asset Management

Third Party must have policies and processes to classify information in terms of its value, criticality and confidentiality.

Risk Assessment

Third Party must conduct annual external Penetration Testing on its IT infrastructure systems, and internet facing applications.

Risk Management Strategy

Third Party must have a process to conduct Cybersecurity Risk Assessment on regular basis, to identify, assess and remediate Risks to data and information systems.

Protect

Protection consists of four parts:

Access Control

Password protection measures must be enforced by the Third Party

Data Security

how to secure systems, data, documents, and applications

Information Protection Processes and Procedures

Third Party must have a Disaster Recovery Plan (DR Plan) which is documented, maintained and communicated to appropriate parties

Protective Technology

describe how key systems and technologies should be protected, including the use of intrusion detection systems (IDS)

Respond

Response consists of three parts:

Communications

incident management policy and plan

Analysis

The incident response capability and tracking of all cybersecurity incidents

Mitigation

vulnerabilities should be resolved or mitigated

Detect Third Party Cybersecurity Controls For Cybersecurity Compliance Certificate

Detection consists of two parts:

Anomalies and Events

Third Party must monitor Technology Assets, Systems and applications to identify unauthorized access, or unauthorized activity.

Continuous Monitoring

Multiple physical security measures must be implemented to prevent unauthorized access to facilities. Entrances and exits must be secured with authentication card key, door locks and monitored by video cameras.