# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 2 Materials and Methods
### Overview of IoT Security Best Practices
#### 2.1.1 Adopter Specific IoT Security Best Practices  
This subsubsection provides an overview of the selected IoT security best practices which are applicable only to IoT adopters, namely the adopter specific IoT security guidelines and the adopter specific IoT security framework. **Adopter Specific IoT Security Guidelines**  
The IoT security best practices below are guidelines that address generic-based IoT security controls [44], IoT recommendations specific to Identity and Access Management [45], or healthcare-specific IoT security good practices [57]. These selected guidelines are outlined below:  
* **CSA's Security Guidance for Early Adopters of the Internet of Things (IoT):** Provides key challenges for secure IoT adoption and recommended security controls for IoT adopters to implement at different layers of the protocol stack [18]. The recommended controls are grouped into seven categories which focus on IoT privacy impact assessment and privacy-by-design, secure IoT systems engineering, layered security protections for IoT assets, data protection, security controls for IoT devices, authentication/authorization framework for IoT deployments, and logging and audit framework for IoT environment [44];
* **CSA's Identity and Access Management for the Internet of Things--Summary Guidance:** Extends the guidance on IoT Identity and Access Management (IAM) from [44]. It provides a set of IAM related recommendations to support IoT adopters [45];
* **ENISA's Procurement Guidelines for Cybersecurity in Hospitals Good practices for the security of Healthcare services:** This report focuses on providing cybersecurity guidelines to healthcare organizations for improving their procurement process of medical devices and applies to healthcare professionals including Chief Information Security Officers (CISOs), Chief Technology Officers (CTOs), IT teams, and procurement officers. First, the report provides cybersecurity considerations for planning, sourcing, and managing procured systems and services which are further grouped into ten procurement types. Then, it provides an overview of cybersecurity-related regulations, international standards, and good practices for healthcare systems, products, and services, and outlines the relevance of each of these best practices to the selected \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Applicability** & **Type** & **IoT Security Best Practice** & **Reference** \\ \hline \multirow{8}{*}{Manufacturer specific} & \multirow{8}{*}{Standards} & ETSI European Standard (EN) 303.645 V2.1.1 Cyber Security for Consumer Internet of Things: & [30] \\  & & Baseline Requirements & \\  & & NEMA’s Cyber Hygiene Best Practices & [52] \\ \cline{2-4}  & & BITAG’s Internet of Things (IoT) Security and & [43] \\  & & Privacy Recommendations & \\  & & CSDE’s The C2 Consensus on IoT Device Security & [26] \\  & & Baseline Capabilities & \\  & & IEEE’s Internet of Things (IoT) Security Best Practices & [49] \\  & & NIST’s Foundational Cybersecurity Activities for IoT & [53] \\  & & Device Manufacters & \\ \hline \multirow{8}{*}{Supplier specific} & \multirow{8}{*}{Codes of practice} & UK DCMS’s Code of Practice for Consumer IoT Security & [61] \\  & & Australian Government’s Code of Practice Securing the & [42] \\ \cline{1-1}  & & Internet of Things for Consumers & \\ \cline{1-1} \cline{2-4}  & & AIOTI’s Report on Workshop on Security and Privacy in & [41] \\ \cline{1-1}  & & the Hyper-Connected World & [41] \\ \cline{1-1}  & & U.S. NHTSA’s Cybersecurity Best Practices for & [60] \\ \cline{1-1}  & & Modern Vehicles & \\ \cline{1-1} \cline{2-4}  & & FEMeuworks & GSMA’s IoT Security Assessment Checklist Version 3.0 & [47] \\ \cline{1-1}  & & IoTSF’s IoT Security Compliance Framework Release 2.1 & [50] \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._procurement types. Furthermore, the report provides key cybersecurity challenges, a cyber threat taxonomy, and key procurement-related risks for hospitals.