Software Company With
Right Technology Great Experience Business Knowledge

Best in class software solutions for automation
AND
To secure critical IT infrastructure!

WhatsApp Us For Saudi Aramco CCC

Saudi Aramco Cyber Security Certificate -
Premier!
Riyadh - Kingdom of Saudi Arabia

Job Category:Assistance for Saudi Aramco Cyber Security Certificate

Location:Riyadh - Kingdom of Saudi Arabia

Date:April 2025

PremierQ is a regional leader in creating world-class sports, recreation, and community spaces, combining international best practices with Gulf-specific insights. We specialize in end-to-end solutions, from design and development to constructing sports facilities, aquatic areas, adventure parks, and nature-inspired play spaces. Our offices and operations are in Riyadh, Bahrain, Dammam and Al Ula.

Gap Analysis

Before starting project activities, we carried out a detailed gap analysis of the organization IT infrastructure. This assessment helped us identify strengths, weaknesses, and areas needing improvement. By benchmarking the existing setup against industry best practices and future requirements, we gained a clear view of the challenges ahead. The findings not only offered a complete picture of the work required but also provided a solid foundation for prioritizing initiatives and implementing effective, long-term solutions

Update of Infrastructure

Following the gap analysis, we launched a structured program to upgrade the IT infrastructure and meet the requirements for the Third-Party Cybersecurity Compliance Certificate. The initiative focused on several critical activities, including creating a comprehensive asset inventory, updating operating systems, migrating databases to secure local servers, implementing static IP configurations, enhancing office productivity tools, and reinforcing Wi-Fi security. Collectively, these upgrades built a stronger and more resilient technology environment, ensuring both regulatory compliance and long-term protection of organizational assets.

Compilation of an Acceptable Use Policy (AUP)

The Acceptable Use Policy (AUP) acts as a framework for both technical and practical aspects of internal and external cybersecurity. Developed in line with SANS Institute standards and other leading best practices, the policy provides IT administrators with clear operational guidance while educating employees on the responsible use of company systems. It also incorporates key documentation, such as Aramco Cybersecurity Incident Response forms, employee exit checklists, information sanitization procedures, and employee confirmations of training and policy acceptance.

Group Policies via Domain Controller

A Microsoft Domain Controller was implemented to centralize network administration, with all laptops, desktops, and servers integrated into the domain. Group Policy Objects (GPOs) were configured to enforce critical security controls such as password complexity, renewal schedules, reuse restrictions, account lockout thresholds, and automatic screen locking. Additional measures included restricting display settings, disabling file transfers via USB and DVD, blocking command prompt access, and enforcing operating system updates. Browser policies prevented password storage, while Internet Explorer was disabled and redirected to Microsoft Edge.

Firewall implementation

To strengthen the network perimeter, a Sophos firewall appliance was deployed, supported by a subscription to Sophos Xstream Protection. This advanced security suite delivers deep packet inspection, encrypted traffic analysis, network and web protection, zero-day threat defense, machine learning driven detection, and centralized orchestration with premium support. Remote access to internal resources was further secured through multi-factor authentication, enabled by the Sophos Authenticator app. The app generates both time-based and event-based one-time passwords (OTP) in compliance with RFC 6238 and RFC 4226..

End-Point Security

All organizational devices were secured with Kaspersky Endpoint Security for Business Advanced, providing comprehensive protection across the IT environment. Centralized management through the Kaspersky Control Center enabled effective policy enforcement and monitoring of endpoints. These policies included real-time device tracking, daily antivirus database updates, and scheduled weekly deep scans. Additional safeguards were applied through patch management, file encryption, and enhanced server protection. Collectively, these measures established a multi-layered defense framework to minimize risks, strengthen resilience, and protect critical information assets.

Microsoft 365 Services

To enhance email security, multi-factor authentication (MFA) was enforced across all Microsoft 365 services, with every user successfully enrolled. The control requires users to verify sign-in attempts through the Microsoft Authenticator app, adding a strong second layer of protection beyond passwords. Suspicious or unauthorized login requests can be instantly denied by the user, effectively blocking threat actors. This proactive measure significantly reduces the risk of account compromise and strengthens overall business email protection.

Cyber Security Training

All employees completed a comprehensive cybersecurity training program aimed at strengthening awareness and resilience against evolving threats. The program covered core areas such as cybersecurity fundamentals, acceptable use of company systems, and the dangers of social engineering and phishing. Modules also addressed password hygiene, data protection, ransomware, malware, imposter scams, and email spoofing. Practical guidance on clean desk practices, safe internet use, and daily security tips equipped staff with the skills to recognize risks and respond effectively.

Secure Sanitization

As mandated by the Third-Party Cybersecurity Compliance Certificate, all data must be sanitized in compliance with NIST 800-88 or equivalent standards at the end of its lifecycle, after the retention period, or before device reassignment or destruction. We recommended four certified software solutions that meet global benchmarks, including the NCSC, NATO, Common Criteria (EAL+3), ADISA, HIPAA, Sarbanes-Oxley, and German VSITR. The Acceptable Use Policy (AUP) further outlines approved sanitization methods, secure storage of sanitized drives, and procedures for the destruction of unusable media.

Sender Policy Framework (SPF)

Sender Policy Framework (SPF) is an essential email authentication protocol that helps prevent spoofing and phishing. By publishing an SPF record in the domain DNS, organizations define which mail servers are authorized to send messages on their behalf. When an email is received, the recipient mail server validates the sending server against the SPF record to confirm authenticity. This verification minimizes the risk of forged emails, enhances domain reputation, and improves both email deliverability and overall trust in communications.

Email Anti Malware and Spam Protection

The mail server was reinforced with advanced anti-malware and anti-spam policies to safeguard organizational communications. These controls proactively block malicious content, manage bulk messages, and leverage Microsoft Safe Links and Safe Attachments to neutralize harmful URLs and files before they reach users. The anti-spam framework further filters unsolicited or suspicious content, strengthening defenses against phishing and spoofing attempts. Collectively, these measures secure both inbound and outbound traffic, reduce exposure to cyber threats, and significantly enhance the resilience of the organization email systems.

DomainKeys Identified Mail (DKIM) Implementation

DomainKeys Identified Mail (DKIM) is an email authentication protocol that allows organizations to apply a cryptographic digital signature to outbound messages. This signature is validated by receiving mail servers, confirming that the email originates from an authorized source and has not been altered in transit. DKIM was implemented across the organization email systems to strengthen authenticity, build trust, and mitigate risks such as spoofing, phishing, and other email-based cyber threats.

Compilation of Evidences and Discussion
with 3rd Party IT Auditors

After completing the implementation of all cybersecurity requirements, evidence was compiled from multiple sources to validate compliance. For each control, screenshots were taken with date, time, domain, and user details using administrator-level commands. Every screenshot was prepared to be clear, properly referenced, and aligned with the Third-Party Control (TPC) framework. Each TPC submission included the correct reference number and concise comments, ensuring the auditor could easily verify the material. Following submission, the auditor reviewed the evidence, engaged in detailed discussions with our team, and conducted live validation tests. Their review covered the firewall, endpoint protection, group policy objects, and selected user terminals. Once satisfied that all controls were accurately implemented and functioning as required, the IT auditor confirmed full compliance and formally issued the Third-Party Cybersecurity Compliance Certificate, marking the successful completion of the certification process and strengthening our client overall security posture.

Software Company With Right Technology Great Experience Business Knowledge

Best in class software solutions for automation ANDTo secure critical IT infrastructure!