Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Third-Party Risk Management
  4. >Third-Party Risk Management - Objective 2
  5. >C2M2-THIRD-PARTIES-2I
C2M2-THIRD-PARTIES-2IActive

Selection criteria for products include consideration of end-of-life and end-of-support timelines

Statement

Selection criteria for products include consideration of end-of-life and end-of-support timelines

Location

Domain
Third-Party Risk Management
Objective
Third-Party Risk Management - Objective 2

Practice Details

Identifier
C2M2-THIRD-PARTIES-2I
Domain
Third-Party Risk Management
Objective
Objective 2
Maturity Level
MIL-3

Help Text

Third parties should be selected according to an organized and thorough process and according to explicit specifications and selection criteria. The selection process and criteria should be designed to ensure that the selected entity can fully meet the organization’s specifications as established. These criteria should include expected product life and product support periods.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: THIRD-PARTIES-2b, THIRD-PARTIES-2i, THIRD-PARTIES-2j, THIRD-PARTIES-2k, THIRD-PARTIES-2l, THIRD-PARTIES-2m.

AESCSF
AESCSF-THIRD-PARTIES-2iequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Third-Party Risk Management - Objective 2
Third-Party Risk Management - Objective 213 controls
C2M2-THIRD-PARTIES-2AThe selection of suppliers and other third parties includes consideration of their cybersecurity qualifications, at least in an ad hoc mannerC2M2-THIRD-PARTIES-2BThe selection of products and services includes consideration of their cybersecurity capabilities, at least in an ad hoc mannerC2M2-THIRD-PARTIES-2CA defined method is followed to identify cybersecurity requirements and implement associated controls that protect against the risks arising from suppliers and other third partiesC2M2-THIRD-PARTIES-2DA defined method is followed to evaluate and select suppliers and other third partiesC2M2-THIRD-PARTIES-2EMore rigorous cybersecurity controls are implemented for higher priority suppliers and other third partiesC2M2-THIRD-PARTIES-2FCybersecurity requirements (for example, vulnerability notification, incident-related SLA requirements) are formalized in agreements with suppliers and other third partiesC2M2-THIRD-PARTIES-2GSuppliers and other third parties periodically attest to their ability to meet cybersecurity requirementsC2M2-THIRD-PARTIES-2HCybersecurity requirements for suppliers and other third parties include secure software and secure product development requirements where appropriateC2M2-THIRD-PARTIES-2ISelection criteria for products include consideration of end-of-life and end-of-support timelinesC2M2-THIRD-PARTIES-2JSelection criteria include consideration of safeguards against counterfeit or compromised software, hardware, and servicesC2M2-THIRD-PARTIES-2KSelection criteria for higher priority assets include evaluation of bills of material for key asset elements, such as hardware and softwareC2M2-THIRD-PARTIES-2LSelection criteria for higher priority assets include evaluation of any associated third-party hosting environments and source dataC2M2-THIRD-PARTIES-2MAcceptance testing of procured assets includes consideration of cybersecurity requirements