Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Third-Party Risk Management
  4. >Third-Party Risk Management - Objective 2
  5. >C2M2-THIRD-PARTIES-2E
C2M2-THIRD-PARTIES-2EActive

More rigorous cybersecurity controls are implemented for higher priority suppliers and other third parties

Statement

More rigorous cybersecurity controls are implemented for higher priority suppliers and other third parties

Location

Domain
Third-Party Risk Management
Objective
Third-Party Risk Management - Objective 2

Practice Details

Identifier
C2M2-THIRD-PARTIES-2E
Domain
Third-Party Risk Management
Objective
Objective 2
Maturity Level
MIL-2

Help Text

Not all suppliers expose an organization to the same level of risk. Since contractually imposing specific cybersecurity requirements can result in increased costs, consideration should be taken to ensure cybersecurity requirements are proportional to potential risk. Additional consideration should be given to high priority suppliers (THIRD-PARTIES-1c) because they supply, maintain, or operate critical software components that are essential to the operation of the function. The definition of a critical software component may vary widely depending on industry or critical infrastructure sector and may be informed by commonly used frameworks or control sets. For example, NIST provides a definition of critical software under Executive Order 14028 that some organizations may be required to adopt. The organization should implement more rigorous cybersecurity controls if it is determined that the financial impact of a potential risk would be greater than the calculated cost of the risk.

Related Practices · Input From: Implementing THIRD-PARTIES-1d provides input that may be useful for implementing this practice. · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: THIRD-PARTIES-2c, THIRD-PARTIES-2e.

AESCSF
AESCSF-THIRD-PARTIES-2eequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Third-Party Risk Management - Objective 2
Third-Party Risk Management - Objective 213 controls
C2M2-THIRD-PARTIES-2AThe selection of suppliers and other third parties includes consideration of their cybersecurity qualifications, at least in an ad hoc mannerC2M2-THIRD-PARTIES-2BThe selection of products and services includes consideration of their cybersecurity capabilities, at least in an ad hoc mannerC2M2-THIRD-PARTIES-2CA defined method is followed to identify cybersecurity requirements and implement associated controls that protect against the risks arising from suppliers and other third partiesC2M2-THIRD-PARTIES-2DA defined method is followed to evaluate and select suppliers and other third partiesC2M2-THIRD-PARTIES-2EMore rigorous cybersecurity controls are implemented for higher priority suppliers and other third partiesC2M2-THIRD-PARTIES-2FCybersecurity requirements (for example, vulnerability notification, incident-related SLA requirements) are formalized in agreements with suppliers and other third partiesC2M2-THIRD-PARTIES-2GSuppliers and other third parties periodically attest to their ability to meet cybersecurity requirementsC2M2-THIRD-PARTIES-2HCybersecurity requirements for suppliers and other third parties include secure software and secure product development requirements where appropriateC2M2-THIRD-PARTIES-2ISelection criteria for products include consideration of end-of-life and end-of-support timelinesC2M2-THIRD-PARTIES-2JSelection criteria include consideration of safeguards against counterfeit or compromised software, hardware, and servicesC2M2-THIRD-PARTIES-2KSelection criteria for higher priority assets include evaluation of bills of material for key asset elements, such as hardware and softwareC2M2-THIRD-PARTIES-2LSelection criteria for higher priority assets include evaluation of any associated third-party hosting environments and source dataC2M2-THIRD-PARTIES-2MAcceptance testing of procured assets includes consideration of cybersecurity requirements