# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 3 Results
### Our Proposed IoTSRM2
The organization's IoT suppliers have and maintain plans that cover the definition of security metrics for measuring the performance of IoT services against Service Level Objectives (SLOs), and the means for metrics reporting including dashboards and communication plans. The informative references for this IoTSRM2 control are [48]; [53]: 4.1; [56; 58]. **IoT security training and awareness plan (GV.D.4):** An organization-wide IoT security training and awareness plan, which is aligned with and part of the organization's cybersecurity training and awareness program, is documented, formally approved, periodically reviewed, and up-to-date. The organization's IoT suppliers make available user guides or manuals for the IoT products and/or services they provide, and they have plans in place for delivering IoT security and privacy training to IoT systems and/or software engineers. The informative references for this IoTSRM2 control are [28;30]; [40]; [41; 43; 45]; [46]: TRN-01, TRN-02; [50]: 2.4.12.11, 2.4.12.12; [51]: Principle 2: Key concept 7; [53]: 4.2, 4.2.3, 4.2.6; [54]; [55]: OP-19, OP-20, OP-21, OP-23; [56]: GP 21, GP 27; [58; 60]. **IoT security incident response plan (GV.D.5):** An IoT security incident response plan is documented, formally approved, periodically reviewed, up-to-date, readily available to staff, and involves relevant outside parties. This plan is aligned with and part of wider cybersecurity incident response and crisis management plans which are regularly reviewed, tested, and updated. The organization's IoT suppliers have and maintain cybersecurity incident response plans which incorporate IoT security considerations and shared responsibilities with IoT adopters, and they communicate these plans to IoT adopters. The informative references for this IoTSRM2 control are [28]; [40]: 40; [44; 45]; [46]: IMT-02; [47; 48]; [50]: 2.4.3.8, 2.4.3.21; [55]: OP-10, OP-11, OP-12; [57]: GP 22, GP 23; [60]. **IoT vulnerability management plan (GV.D.6):** An IoT vulnerability management plan, which is aligned with and supports the overall vulnerability management program, is established, documented, formally approved, periodically reviewed, and up-to-date. The organization's IoT suppliers have and maintain vulnerability management plans for keeping internal infrastructure and applications updated, and vulnerability disclosure plans to enable third party vulnerability reporting, disclosure of vulnerabilities, and release of security advisories and patches for the IoT systems they provide. The informative references for this IoTSRM2 control are [28]; [40]: 2, 9; [46]: OPA-01, VLN-01; [47; 49]; [50]: 2.4.3.7, 2.4.3.9, 2.4.13.5; [51]: Principle 5: Key Concept 17; [52]; [53]: 4.2.4; [54]; [55]: OP-14, OP-15, OP-16, OP-18; [56]; [57]: GP 24, GP 26; [58; 59; 60]. **IoT End-of-Life plan (GV.D.7):** An IoT End-of-Life plan, which is aligned with and part of the organization's decommissioning strategy, is defined, documented, approved by board committees and/or C-suite executives, periodically reviewed, up-to-date, and well communicated across the organization. The organization's IoT suppliers have and maintain End-of-Life policies and communicate their sunsetting plans, practices, and implications to IoT adopters. The informative references for this IoTSRM2 control are [28]; [40]: 33; 34; [46]: EOL-01; [47; 49]; [53]: 3.4, 4.2.2, 4.2.5; [55]: OP-01; [56; 58; 59]. Then, for each IoTSRM2 objective of the \"Governance\" domain, Table 6 provides the unique identifier of the in-scope NIST CSF Subcategory and the associated IoTSRM2 controls with their adjusted weights. These IoTSRM2 controls are prioritized within each IoTSRM2 objective.