## 3 Methodology
* **Operations phase--**secure remote management of changes related to configurations, software, cybersecurity, or networks, as well as the secure updating of software. Obtaining information and data about wear and tear as well as information about any problems occurring and potentially also have functionality for actions related to the degradation or stopping of operations or safety before an imminent breakdown of the hardware. * **De-commissioning, de-installation, and wiping phase--**wiping/erasing of secret data, information, recipes, process settings, network, and security configurations, sensitive info such as user manuals and how to set up cybersecurity, software or other IPR, and encryption keys and revoke certificates prior to potential continued usage in a new setting or a next lifecycle
* **Product use information--**the ability to collect how the products are used (and if they deviate from what is expected), maintained, and if there is a need for maintenance, as well as to keep track of which versions of hardware, software, etc., are used in each installation. Further, this information and data should be analyzed to find systemic and common problems and possibilities for improvements (i.e., new or changed requirements) to store in the technical debt repository until the next design, development, and test iteration. It is important to remember that the fleet management functionality [5; 9; 22] may require openings in the firewalls of standalone or Internet-exposed IoT products, or to organizations' network firewalls to enable needed connections. If such openings are not possible, it can be expected that the cost of support and maintenance will be substantially higher. Thus, the fleet management functionality must itself be cybersecure to not open for vulnerabilities and threats. Due to the expected increasing level of cybersecurity requirements imposed by the EU and other parts of the world's legal and regulatory developments, software related to applications, operating systems, firmware, open-source software, and software frameworks used must be updatable and upgradable in a secure manner to stay current [8; 20; 21]. Further, the hardware used may also need to be updatable and upgradable if cybersecurityrequires that and issues cannot be fixed via, for instance, firmware, operating system, or additional cybersecurity software controls. In addition, the products must have clearly stated content and origin, as well as factors influencing them, along with documented availability of service, support, and spare parts, etc. (c.f., EU's Digital Product Passports (DPP) ([[https://commission.europa.eu/energy-climate-change-environment/standards-tools-and-labels/products-labelling-rules-and-requirements/sustainable-products/ecode](https://commission.europa.eu/energy-climate-change-environment/standards-tools-and-labels/products-labelling-rules-and-requirements/sustainable-products/ecode)]([https://commission.europa.eu/energy-climate-change-environment/standards-tools-and-labels/products-labelling-rules-and-requirements/sustainable-products/ecode](https://commission.europa.eu/energy-climate-change-environment/standards-tools-and-labels/products-labelling-rules-and-requirements/sustainable-products/ecode)) sign-sustainable-products-regulation_en (accessed on 20 March 2024))) and (32), which, hopefully, will become compliant with international trade rules to not cause expensive and unnecessary difficulties). The evaluation results with feedback and verification, regarding the draft initial model, were collected during interviews with the following four companies:  
* **Micro-SME #1**--during the primary lifecycle, if an IoT product is returned from a customer or after a short-term test, we commonly recondition/re-manufacture the hardware by swapping out the plastic cover and doing a cleaning if needed prior to re-packaging and continued operation in either the primary or a secondary lifecycle.