# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 2 Materials and Methods
### Overview of IoT Security Best Practices  
There are numerous best practices in the literature relevant to IoT security. Although this overview does not provide an exhaustive list of IoT security best practices, it focuses on some of the most renowned best practices which are relevant to IoT security irrespective of their target audience, are applicable vertically or horizontally across sectors, and are available in English. In this context, the identification of the in-scope IoT security best practices is based on the current state of the art (i.e., [18; 24]), available mappings of IoT security recommendations, guidance, and standards to IoT security best practices (i.e., [25; 26; 27; 28; 29]), and references to IoT security best practices from other research works (i.e., [30; 31]). This identification is also based on online searches of IoT security initiatives from the Cloud Security Alliance (CSA), the European Union Agency for Cybersecurity (ENISA), and the National Institute of Standards and Technology (NIST). With respect to exclusions, this overview does not cover exclusively technically-focused IoT security best practices or IoT security best practices which are intended for the purpose of certification. Moreover, this overview focuses on final versions of IoT security best practices and does not cover draft or expired ones. Furthermore, it does not cover cybersecurity best practices that are not IoT security specific, and it does not capture vendor reports that address IoT security best practices. Therefore, the main categories of IoT security best practices that are considered beyond the scope of this overview are listed below along with a few notable examples of best practices:  
* **Exclusively technically-focused IoT security best practices**, such as: \(\bigcirc\) Concise Binary Object Representation (CBOR) Object Signing and Encryption (COSE) published by Internet Engineering Task Force (IETF) [32]
* **IoT security best practices intended for the purpose of certification**, such as: \(\bigcirc\) CTIA Cybersecurity Certification Test Plan for IoT Devices, Version 1.2.2 issued by CTIA Certification [33]
* PSA Certified(tm) Level 1 Questionnaire, Version 2.1 published by Platform Security Architecture (PSA) Joint Stakeholder Agreement (JSA) Members [34]
* **Draft IoT security best practices**, such as: \(\bigcirc\) oneM2M TR-0008-V2.0.1 Security (Technical Report) issued by oneM2M Partners [35]* **Expired IoT security best practices**, such as: \(\bigcirc\)  Best Current Practices for Securing Internet of Things (IoT) Devices [36]
* **Cybersecurity best practices that are not IoT security specific**, such as: \(\bigcirc\)  The Open Web Application Security Project (OWASP) Secure Coding Practices Quick Reference Guide [37]
* **Fundamental Practices for Secure Software Development 2 nd Edition A Guide to the Most Effective Secure Development Practices in Use Today published by Software Assurance Forum for Excellence in Code (SAFECode) [38]**
* **Systems Security Engineering Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure System published by National Institute of Standards and Technology (NIST) [39]**
* **Vendor reports covering IoT security best practices**, such as: \(\bigcirc\)  AT&T Cybersecurity Insights: The CEO's Guide to Securing the Internet of Things [7]**  
Thus, Table 1 illustrates the 25 selected IoT security best practices, and outlines for each best practice its corresponding publisher and reference.