Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Third-Party Risk Management
  4. >Third-Party Risk Management - Objective 2
  5. >C2M2-THIRD-PARTIES-2B
C2M2-THIRD-PARTIES-2BActive

The selection of products and services includes consideration of their cybersecurity capabilities, at least in an ad hoc manner

Statement

The selection of products and services includes consideration of their cybersecurity capabilities, at least in an ad hoc manner

Location

Domain
Third-Party Risk Management
Objective
Third-Party Risk Management - Objective 2

Practice Details

Identifier
C2M2-THIRD-PARTIES-2B
Domain
Third-Party Risk Management
Objective
Objective 2
Maturity Level
MIL-1

Help Text

The cybersecurity requirements for products and services might include, for example, ability to disable certain functionality of a product, a clear understanding of components used in a product, and terms of service for a service that meet cybersecurity requirements.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: THIRD-PARTIES-2b, THIRD-PARTIES-2i, THIRD-PARTIES-2j, THIRD-PARTIES-2k, THIRD-PARTIES-2l, THIRD-PARTIES-2m.

AESCSF
AESCSF-THIRD-PARTIES-2bequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Third-Party Risk Management - Objective 2
Third-Party Risk Management - Objective 213 controls
C2M2-THIRD-PARTIES-2AThe selection of suppliers and other third parties includes consideration of their cybersecurity qualifications, at least in an ad hoc mannerC2M2-THIRD-PARTIES-2BThe selection of products and services includes consideration of their cybersecurity capabilities, at least in an ad hoc mannerC2M2-THIRD-PARTIES-2CA defined method is followed to identify cybersecurity requirements and implement associated controls that protect against the risks arising from suppliers and other third partiesC2M2-THIRD-PARTIES-2DA defined method is followed to evaluate and select suppliers and other third partiesC2M2-THIRD-PARTIES-2EMore rigorous cybersecurity controls are implemented for higher priority suppliers and other third partiesC2M2-THIRD-PARTIES-2FCybersecurity requirements (for example, vulnerability notification, incident-related SLA requirements) are formalized in agreements with suppliers and other third partiesC2M2-THIRD-PARTIES-2GSuppliers and other third parties periodically attest to their ability to meet cybersecurity requirementsC2M2-THIRD-PARTIES-2HCybersecurity requirements for suppliers and other third parties include secure software and secure product development requirements where appropriateC2M2-THIRD-PARTIES-2ISelection criteria for products include consideration of end-of-life and end-of-support timelinesC2M2-THIRD-PARTIES-2JSelection criteria include consideration of safeguards against counterfeit or compromised software, hardware, and servicesC2M2-THIRD-PARTIES-2KSelection criteria for higher priority assets include evaluation of bills of material for key asset elements, such as hardware and softwareC2M2-THIRD-PARTIES-2LSelection criteria for higher priority assets include evaluation of any associated third-party hosting environments and source dataC2M2-THIRD-PARTIES-2MAcceptance testing of procured assets includes consideration of cybersecurity requirements