# Challenges and Opportunities for Conducting Dynamic Risk Assessments in Medical IoT
## 3 Systematic Literature Review  
We conducted an SLR to better understand how researchers consider risk assessment in MIoT/IoT. It employed the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 recommendations [78], following the 27-point checklist for deriving a substantial synthesis of research priorities, where we use the relevant items as dictated by the PRISMA process. We provide below a summary of the PRISMA 2020 Checklist (referring to items from the recommendations as #) with regard to the 'Introduction' and 'Methods':  
* Rationale (#3)--the literature about risks in MIoT must be better understood. In past years there has been a proliferation of research that would profit from synthesis and discussion to organise knowledge and identify gaps. * Objectives (#4)--the guiding question is _\"What are the factors underpinning risk assessments in MIoT?\"_. * Eligibility criteria (#5)--as inclusion criteria, we are interested in the latest results (published in the last five years, i.e., May 2018 to May 2023) mentioning risk assessment (any type, i.e., normal, i.e., in this context, we refer to the _usual_ way organisationsconduct RA, by following guidelines and deriving the most likely risk scenarios that could arise, vulnerabilities, impact and mitigation effort that follows--or dynamic, describing case studies in healthcare that used MIoT for data gathering and communication). Our exclusion criteria do not consider any poster not providing fundamental research outcomes, results not focused on cyber security or privacy, as well as RA that does not consider the use of IoT/MIoT. * Information sources (#6)--Google Scholar, ACM Digital Library and IEEE explore (Respectively, [[https://scholar.google.com](https://scholar.google.com)]([https://scholar.google.com](https://scholar.google.com)), accessed on 19 June 2023, [[https://dl.acm.org](https://dl.acm.org)]([https://dl.acm.org](https://dl.acm.org)), accessed on 19 June 2023, and [[https://ieeexplore.ieee.org](https://ieeexplore.ieee.org)]([https://ieeexplore.ieee.org](https://ieeexplore.ieee.org)), accessed on 19 June 2023). * Query: (dynamic risk assessment or risk assessment) and (\"medical IoT\" or MIoT) and healthcare and (cybersecurity or \"cyber security\" or cyber-security). We adapted it to match the particularities of the information source under scrutiny. * Selection process (#8)--case studies employing risk assessment of MIoT/IoT in healthcare settings. * Data collection process (#9)--we performed the search, analysed titles and abstracts and then retrieved the entire paper for in-depth inspection as to eligibility. * Data items (#10)--for the selected papers that passed previous stages of scrutiny, we extracted RA methodology and relevant risk-related components, healthcare settings (if any), MIoT/IoT specification (if any), year and case study explanation. Depending on the selected research, we were interested in any cyber-attack or specific vulnerability comprising MIoT/IoT devices. Our guiding search strategy was directed at RA approaches that were either static/periodic or dynamic. We also investigated the security issues that the technologies try to solve or tackle, i.e., blockchains used for trust parties, lightweight authentication, or fast encryption for confidential data manipulation. In addition, we addressed the most likely types of cyber-attacks that threat actors could attempt when abusing systems. We tweaked the searching input query to match the specific requirements of the information sources--for instance, using parentheses is mandatory to convey precise relationships. For Google Scholar, we executed the template query explained above and then selected the \"Custom Range\" parameter to retrieve papers sorted by relevance from 2017 to 2022. As this platform does not only scan scientific venues per se, we were interested in all retrieved gray literature, such as dissertations, manuals, and white papers. Specifically for ACM-DL, the mechanism required logical connectors all to be upper-case.