Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Cybersecurity Architecture
  4. >Cybersecurity Architecture - Objective 3
  5. >C2M2-ARCHITECTURE-3H
C2M2-ARCHITECTURE-3HActive

Cybersecurity controls are implemented for all assets within the function either at the asset level or as compensating controls where asset-level controls are not feasible

Statement

Cybersecurity controls are implemented for all assets within the function either at the asset level or as compensating controls where asset-level controls are not feasible

Location

Domain
Cybersecurity Architecture
Objective
Cybersecurity Architecture - Objective 3

Practice Details

Identifier
C2M2-ARCHITECTURE-3H
Domain
Cybersecurity Architecture
Objective
Objective 3
Maturity Level
MIL-2

Help Text

This practice extends the architectural tactics for cybersecurity controls beyond assets that are important to the delivery of the function to include all assets used for the delivery of the function. The practice also requires that cybersecurity controls be implemented at the asset level where feasible. Compensating controls should be implemented in situations where an asset does not support cybersecurity controls at the asset level to sufficiently reduce risk. For example, if an asset does not support encrypted communications, no direct connections should be permitted with the device and all communications should be routed through an intermediary device.

Related Practices · Input From: Implementing ASSET-1f and ASSET-2f provides input that may be useful for implementing this practice. · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ARCHITECTURE-3a, ARCHITECTURE-3b, ARCHITECTURE-3c, ARCHITECTURE-3d, ARCHITECTURE-3h, ARCHITECTURE-3k.

AESCSF
AESCSF-ARCHITECTURE-3hequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Cybersecurity Architecture - Objective 3
Cybersecurity Architecture - Objective 313 controls
C2M2-ARCHITECTURE-3ALogical and physical access controls are implemented to protect assets that are important to the delivery of the function, where feasible, at least in an ad hoc mannerC2M2-ARCHITECTURE-3BEndpoint protections (such as secure configuration, security applications, and host monitoring) are implemented to protect assets that are important to the delivery of the function, where feasible, at least in an ad hoc mannerC2M2-ARCHITECTURE-3CThe principle of least privilege (for example, limiting administrative access for users and service accounts) is enforcedC2M2-ARCHITECTURE-3DThe principle of least functionality (for example, limiting services, limiting applications, limiting ports, limiting connected devices) is enforcedC2M2-ARCHITECTURE-3ESecure configurations are established and maintained as part of the asset deployment process where feasibleC2M2-ARCHITECTURE-3FSecurity applications are required as an element of device configuration where feasible (for example, endpoint detection and response, host-based firewalls)C2M2-ARCHITECTURE-3GThe use of removeable media is controlled (for example, limiting the use of USB devices, managing external hard drives)C2M2-ARCHITECTURE-3HCybersecurity controls are implemented for all assets within the function either at the asset level or as compensating controls where asset-level controls are not feasibleC2M2-ARCHITECTURE-3IMaintenance and capacity management activities are performed for all assets within the functionC2M2-ARCHITECTURE-3JThe physical operating environment is controlled to protect the operation of assets within the functionC2M2-ARCHITECTURE-3KMore rigorous cybersecurity controls are implemented for higher priority assetsC2M2-ARCHITECTURE-3LConfiguration of and changes to firmware are controlled throughout the asset lifecycleC2M2-ARCHITECTURE-3MControls (such as allowlists, blocklists, and configuration settings) are implemented to prevent the execution of unauthorized code