Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Third-Party Risk Management
  4. >Third-Party Risk Management - Objective 2
  5. >C2M2-THIRD-PARTIES-2J
C2M2-THIRD-PARTIES-2JActive

Selection criteria include consideration of safeguards against counterfeit or compromised software, hardware, and services

Statement

Selection criteria include consideration of safeguards against counterfeit or compromised software, hardware, and services

Location

Domain
Third-Party Risk Management
Objective
Third-Party Risk Management - Objective 2

Practice Details

Identifier
C2M2-THIRD-PARTIES-2J
Domain
Third-Party Risk Management
Objective
Objective 2
Maturity Level
MIL-3

Help Text

Third parties should be selected according to an organized and thorough process and according to explicit specifications and selection criteria. The selection process and criteria should be designed to ensure that the selected entity can fully meet the organization’s specifications as established. These criteria should include safeguards against counterfeit or compromised software, hardware, and services. For example: · Will the supplier disclose the existence of all known methods for bypassing computer authentication in the procured product, often referred to as backdoors, and provide written documentation that all such backdoors created by the supplier have been permanently deleted from the system? · Will the supplier provide summary documentation of the procured product’s security features and security-focused instructions on product maintenance, support, and reconfiguration of default settings? For more examples of vendor procurement criteria that can be derived from procurement language, see the DOE Cybersecurity Procurement Language for Energy Delivery Systems.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: THIRD-PARTIES-2b, THIRD-PARTIES-2i, THIRD-PARTIES-2j, THIRD-PARTIES-2k, THIRD-PARTIES-2l, THIRD-PARTIES-2m.

AESCSF
AESCSF-THIRD-PARTIES-2jequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Third-Party Risk Management - Objective 2
Third-Party Risk Management - Objective 213 controls
C2M2-THIRD-PARTIES-2AThe selection of suppliers and other third parties includes consideration of their cybersecurity qualifications, at least in an ad hoc mannerC2M2-THIRD-PARTIES-2BThe selection of products and services includes consideration of their cybersecurity capabilities, at least in an ad hoc mannerC2M2-THIRD-PARTIES-2CA defined method is followed to identify cybersecurity requirements and implement associated controls that protect against the risks arising from suppliers and other third partiesC2M2-THIRD-PARTIES-2DA defined method is followed to evaluate and select suppliers and other third partiesC2M2-THIRD-PARTIES-2EMore rigorous cybersecurity controls are implemented for higher priority suppliers and other third partiesC2M2-THIRD-PARTIES-2FCybersecurity requirements (for example, vulnerability notification, incident-related SLA requirements) are formalized in agreements with suppliers and other third partiesC2M2-THIRD-PARTIES-2GSuppliers and other third parties periodically attest to their ability to meet cybersecurity requirementsC2M2-THIRD-PARTIES-2HCybersecurity requirements for suppliers and other third parties include secure software and secure product development requirements where appropriateC2M2-THIRD-PARTIES-2ISelection criteria for products include consideration of end-of-life and end-of-support timelinesC2M2-THIRD-PARTIES-2JSelection criteria include consideration of safeguards against counterfeit or compromised software, hardware, and servicesC2M2-THIRD-PARTIES-2KSelection criteria for higher priority assets include evaluation of bills of material for key asset elements, such as hardware and softwareC2M2-THIRD-PARTIES-2LSelection criteria for higher priority assets include evaluation of any associated third-party hosting environments and source dataC2M2-THIRD-PARTIES-2MAcceptance testing of procured assets includes consideration of cybersecurity requirements