RESPONSIBLE WORK. SHARED CONFIDENCE.

Trusted access. Protected information.

Protecting a project includes its people, premises, equipment, drawings, and information. Access should follow the purpose of the work.

Controls to agree for your scope

Two construction professionals planning site activities

BEFORE MOBILIZATIONSecurity & information protection

OUR COMMITMENT

Security & information protection

Our commitment is to respect the client’s security rules and keep project information within authorized channels. Physical site access and digital access must be addressed separately, with clear responsibilities and approvals for each.

Aramco vendor

Smart Assistance Company is an Aramco vendor. We recognize that each assignment carries its own safety, security, qualification, and documentation requirements.

Project-specific assurance

Vendor status is distinct from project-specific technical approvals, workforce qualifications, cybersecurity certificates, and ISO certification. Required credentials and supporting records are confirmed for the applicable scope and validity during project review.

Official reference

Requirements & reference points

Aramco · third-party cybersecurity

Aramco’s third-party cybersecurity program uses SACS-210 and an authorized assessment process. For work subject to this program, confirm classification, the applicable controls, and the required CCC or CCC+ evidence with the client. This website is not evidence of certification.

NCA · Essential Cybersecurity Controls

NCA’s Essential Cybersecurity Controls provide a national control framework. Confirm whether the organization and project are within its scope and whether additional sector or client controls apply.

SDAIA · personal data regulations

Saudi personal data requirements address lawful processing, transparency, individual rights, and controller responsibilities. Assess the actual data flows, service providers, retention, and any cross-border transfers for the project.

Reference review: 17 September 2026

Applicable law, authority instructions, and the client’s current contractual requirements determine the final project controls. Reconfirm revisions before work begins.

Security & information protection

Controls to agree for your scope

Use these planning topics to discuss the work with our team. The responsible project specialists must assess the actual site, specify safe methods, and authorize the work.

01Personnel, visitors & site accessAccess must be authorized for the role and location.

Agree identity checks, client onboarding, passes, induction, visitor escorts, and permitted work areas before arrival.
Confirm any role-specific screening through lawful, client-approved channels; collect only information necessary for the stated purpose.
Define lost-pass reporting, removal of access at assignment end, and who may approve a change of access.

02Assets, vehicles & controlled areasSet clear boundaries around equipment and materials.

Agree vehicle entry, delivery appointments, keys, equipment custody, and material release records.
Follow the client’s restrictions on photography, devices, restricted zones, and disclosure of site layouts.
Confirm the scope and required authorizations before arranging specialist guarding or security services. General site support does not establish a security-service license.

03Confidentiality & data handlingOnly share what is needed, with those authorized to receive it.

Agree document classification, confidentiality obligations, approved recipients, and permitted storage or transfer channels.
Define the processing purpose, lawful basis, access restrictions, retention period, and return or deletion arrangements for personal data.
Confirm applicable privacy notices, rights-request handling, service-provider obligations, and restrictions before any overseas transfer.

04Accounts, devices & cyber incidentsAgree safeguards before connecting to client information or systems.

Review named accounts, minimum necessary permissions, multifactor authentication, device updates, and approved endpoint protection.
Confirm backup and recovery responsibilities, approved remote access, supplier connections, and prompt removal of obsolete access.
Agree how suspected phishing, lost devices, unauthorized disclosure, or compromise is reported and escalated to the client and competent parties within applicable deadlines.

Aramco · supplier resources

A client access pass, supplier registration, workforce qualification, and cybersecurity certificate serve different purposes. Each must be checked separately for the contract, person, or organization concerned.

BEFORE MOBILIZATION

Documentation for project review

The required documents, responsible party, validity, and submission dates should be agreed before mobilization. Availability is confirmed during project review.

Security & information protection / Documentation for project review
Document / record	What to confirm
Site access & custody plan	Authorized roles, passes, vehicles, assets, and exit arrangements.
Confidentiality & data requirements	Agreed recipients, lawful processing, retention, and return or deletion.
Applicable cybersecurity evidence	Client classification, required assessment, certificate scope, and validity where applicable.
Security incident contacts	Named escalation roles, reporting channels, and applicable timelines.

Shared responsibility

The agreed scope must identify the employer, contractor, site operator, and specialist responsibilities. Client approval does not remove an employer’s legal duties or replace competent supervision.

BEFORE MOBILIZATION

Let’s align your site requirements.

Share the scope, location, client requirements, and required evidence. We can discuss responsibilities and the next steps before a proposal is agreed.

Discuss safety & compliance