Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Third-Party Risk Management
  4. >Third-Party Risk Management - Objective 2
  5. >C2M2-THIRD-PARTIES-2K
C2M2-THIRD-PARTIES-2KActive

Selection criteria for higher priority assets include evaluation of bills of material for key asset elements, such as hardware and software

Statement

Selection criteria for higher priority assets include evaluation of bills of material for key asset elements, such as hardware and software

Location

Domain
Third-Party Risk Management
Objective
Third-Party Risk Management - Objective 2

Practice Details

Identifier
C2M2-THIRD-PARTIES-2K
Domain
Third-Party Risk Management
Objective
Objective 2
Maturity Level
MIL-3

Help Text

The creation, manufacturing, and assembly of assets supplied by third-parties often comprise many sub-parts and sub-components sourced from other vendors and suppliers. Organizations that acquire these assets from third-parties may unknowingly inherit cyber risks that have not been identified or mitigated. A bill of materials establishes and itemizes the source of sub-parts and sub-components for acquired assets, including their origin and any additional information that can help the organization establish a determination of inherited risk. Examples of these sub-parts and sub-components could be incorporating software routines from an open source libraries as a component of a software build or the sourcing of parts in a security camera from a known hostile nation-state.

Related Practices · Input From: Implementing ASSET-1c provides input that may be useful for implementing this practice. · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: THIRD-PARTIES-2b, THIRD-PARTIES-2i, THIRD-PARTIES-2j, THIRD-PARTIES-2k, THIRD-PARTIES-2l, THIRD-PARTIES-2m.

AESCSF
AESCSF-THIRD-PARTIES-2kequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Third-Party Risk Management - Objective 2
Third-Party Risk Management - Objective 213 controls
C2M2-THIRD-PARTIES-2AThe selection of suppliers and other third parties includes consideration of their cybersecurity qualifications, at least in an ad hoc mannerC2M2-THIRD-PARTIES-2BThe selection of products and services includes consideration of their cybersecurity capabilities, at least in an ad hoc mannerC2M2-THIRD-PARTIES-2CA defined method is followed to identify cybersecurity requirements and implement associated controls that protect against the risks arising from suppliers and other third partiesC2M2-THIRD-PARTIES-2DA defined method is followed to evaluate and select suppliers and other third partiesC2M2-THIRD-PARTIES-2EMore rigorous cybersecurity controls are implemented for higher priority suppliers and other third partiesC2M2-THIRD-PARTIES-2FCybersecurity requirements (for example, vulnerability notification, incident-related SLA requirements) are formalized in agreements with suppliers and other third partiesC2M2-THIRD-PARTIES-2GSuppliers and other third parties periodically attest to their ability to meet cybersecurity requirementsC2M2-THIRD-PARTIES-2HCybersecurity requirements for suppliers and other third parties include secure software and secure product development requirements where appropriateC2M2-THIRD-PARTIES-2ISelection criteria for products include consideration of end-of-life and end-of-support timelinesC2M2-THIRD-PARTIES-2JSelection criteria include consideration of safeguards against counterfeit or compromised software, hardware, and servicesC2M2-THIRD-PARTIES-2KSelection criteria for higher priority assets include evaluation of bills of material for key asset elements, such as hardware and softwareC2M2-THIRD-PARTIES-2LSelection criteria for higher priority assets include evaluation of any associated third-party hosting environments and source dataC2M2-THIRD-PARTIES-2MAcceptance testing of procured assets includes consideration of cybersecurity requirements