What Is the SABIC Cyber Trust Standard?
The SABIC Cyber Trust Standard is a structured, risk-based cybersecurity compliance programme developed by SABIC — one of the world's largest petrochemical companies — to systematically evaluate and certify the cybersecurity posture of its third-party vendors, suppliers, contractors, and digital service providers. It ensures that every entity with access to SABIC's systems, data, or operational technology meets a defined and auditable security baseline.
As a wholly owned subsidiary of Saudi Aramco since 2020, SABIC operates across 50+ countries with an expansive and complex supply chain. The Cyber Trust Standard was established to manage the cascading cyber risk that this global footprint creates. Rooted in international frameworks including IEC 62443, ISO/IEC 27001, and NIST CSF, the programme is tailored specifically to the risks of the petrochemical and manufacturing sectors.
Important: Compliance with the SABIC Cyber Trust Standard is mandatory for all third parties that connect to, process data for, or operate within SABIC's digital or operational environments. Vendors who fail to achieve or maintain certification risk contract termination and removal from SABIC's approved vendor register.
The Three Cyber Trust Levels
SABIC's Cyber Trust Standard operates on a tiered model with three distinct certification levels. Each level corresponds to the risk profile and depth of integration your organisation has with SABIC's systems and data. Vendors must be assessed at the level that matches their engagement — there is no option to self-select a lower tier.
- Baseline security policy requirements
- Basic access controls and password standards
- Security awareness training for all staff
- Self-assessment with documentation evidence
- Timeline: 1–3 months typically
- All Level 1 controls plus enhanced requirements
- MFA, SIEM, vulnerability management
- Incident response plan and testing
- Third-party audit by SABIC-approved assessor
- Timeline: 3–8 months typically
- All Level 2 controls plus OT/ICS security
- SCADA/ICS network segmentation and hardening
- Advanced threat hunting and red team exercises
- Onsite assessment with live system testing
- Timeline: 6–14 months typically
Core Control Pillars
The SABIC Cyber Trust Standard evaluates vendors across nine core control pillars, each containing multiple sub-controls with specific evidence requirements. Compliance across all applicable pillars is mandatory for certification at any trust level.
Does Your Organisation Need Cyber Trust?
Any organisation that engages commercially or technically with SABIC falls within the programme's scope. Use the table below to understand your applicable trust level based on your engagement profile:
| Vendor Engagement Profile | Required Level | Typical Timeline |
|---|---|---|
| Email/portal interaction — low-sensitivity data exchange | Level 1 | 1–3 months |
| IT software/services with direct network or system access | Level 2 | 3–8 months |
| Managed IT services or cloud services for SABIC workloads | Level 2 | 3–8 months |
| Engineering firms handling SABIC process/design data | Level 2 | 3–8 months |
| OT/ICS/SCADA system vendors or integrators | Level 3 | 6–14 months |
| Critical infrastructure providers or plant-level integrators | Level 3 | 6–14 months |
How to Get Cyber Trust Certified
Achieving SABIC Cyber Trust certification is a structured, evidence-driven process. Partnering with an experienced compliance team like CyberOps from the start dramatically reduces audit risk, accelerates timelines, and increases your first-attempt success rate.
The Real Cost of Non-Compliance
For any vendor doing business with SABIC, the consequences of failing to achieve or maintain Cyber Trust certification extend far beyond the certification programme itself. SABIC treats cybersecurity compliance as a contractual obligation — not an optional best practice.
⚠ Contract Suspension & Vendor Deregistration
Vendors who fail to obtain or maintain a valid Cyber Trust certificate face immediate contract suspension and potential removal from SABIC's global approved vendor register. Reinstatement requires a full re-audit cycle, which can take 3–14 months depending on trust level. For vendors deriving significant revenue from SABIC contracts, this represents a critical business continuity risk that can trigger cascading financial, reputational, and operational consequences.
Beyond direct contract risk, a non-compliant vendor that suffers a security incident affecting SABIC's systems, data, or operations faces significant legal and financial liability. Given SABIC's global reach and its ownership by Saudi Aramco, cybersecurity incidents at the vendor level can have diplomatic and regulatory ramifications extending well beyond Saudi Arabia.
Why CyberOps for SABIC Cyber Trust?
CyberOps has a dedicated SABIC Cyber Trust practice with deep expertise across all three trust levels — from foundational Level 1 assessments to the most complex Level 3 OT/ICS engagements. Our team has supported vendors across multiple industries including petrochemicals, engineering, IT services, logistics, and construction in achieving their Cyber Trust certification on the first attempt.
Our full-service offering covers every phase of the journey: trust level determination, comprehensive GAP assessment against all nine pillars, technical remediation delivery, policy and procedure development, vulnerability assessment and penetration testing, evidence pack compilation, mock audit facilitation, approved assessor coordination, and post-certification continuous monitoring.