Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Third-Party Risk Management
  4. >Third-Party Risk Management - Objective 1
  5. >C2M2-THIRD-PARTIES-1F
C2M2-THIRD-PARTIES-1FActive

Prioritization of suppliers and other third parties is updated periodically and according to defined triggers, such as system changes and external events

Statement

Prioritization of suppliers and other third parties is updated periodically and according to defined triggers, such as system changes and external events

Location

Domain
Third-Party Risk Management
Objective
Third-Party Risk Management - Objective 1

Practice Details

Identifier
C2M2-THIRD-PARTIES-1F
Domain
Third-Party Risk Management
Objective
Objective 1
Maturity Level
MIL-3

Help Text

The organization should review prioritization of third parties to ensure that third parties that pose the greatest risk to the function receive adequate attention. This reevaluation of third-party priority may be driven by a defined timeframe or by defined triggers such as the acquisition of a product from a new vendor or open source information about the financial standing of a company.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: THIRD-PARTIES-1a, THIRD-PARTIES-1b, THIRD-PARTIES-1c, THIRD-PARTIES-1d, THIRD-PARTIES-1e, THIRD-PARTIES-1f.

AESCSF
AESCSF-THIRD-PARTIES-1fequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Third-Party Risk Management - Objective 1
Third-Party Risk Management - Objective 16 controls
C2M2-THIRD-PARTIES-1AImportant IT and OT third-party dependencies are identified (that is, internal and external parties on which the delivery of the function depends, including operating partners), at least in an ad hoc mannerC2M2-THIRD-PARTIES-1BThird parties that have access to, control of, or custody of any IT, OT, or information assets that are important to the delivery of the function are identified, at least in an ad hoc mannerC2M2-THIRD-PARTIES-1CA defined method is followed to identify risks arising from suppliers and other third partiesC2M2-THIRD-PARTIES-1DThird parties are prioritized according to established criteria (for example, importance to the delivery of the function, impact of a compromise or disruption, ability to negotiate cybersecurity requirements within contracts)C2M2-THIRD-PARTIES-1EEscalated prioritization is assigned to suppliers and other third parties whose compromise or disruption could cause significant consequences (for example, single-source suppliers, suppliers with privileged access)C2M2-THIRD-PARTIES-1FPrioritization of suppliers and other third parties is updated periodically and according to defined triggers, such as system changes and external events