# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 3 Results
### Our Proposed IoTSRM2
**Governance (GV)**  
The \"Governance\" domain of IoTSRM2 consists of the following four objectives:  
* Security related policies (GV.A): Determine whether the IoT security related policies are established and communicated;
* Structures and responsibilities (GV.B): Determine whether the IoT security risk management structures, responsibilities, and shared responsibilities are established;
* Regulatory requirements (GV.C): Determine whether cybersecurity-related regulatory requirements are understood and managed;* Governance and risk management plans (G.V.D): Determine whether governance and risk management plans address IoT security risks. _Security related policies (G.V.A)_ The \"Security related policies\" objective has four IoTSRM2 controls. **IoT security policy (G.V.A.1):** An organization-wide IoT security policy, which is aligned with and part of wider overarching cybersecurity policy, is clearly defined, documented, approved by board committees and/or C-suite executives, periodically reviewed, up-to-date, and well communicated. This policy incorporates IoT security requirements relevant for the protection of confidentiality, integrity, availability, and safety of organizational assets (i.e., staff and third parties, processes, technology, data, and facilities). The organization's IoT suppliers have and maintain cybersecurity policies incorporating IoT security considerations, and they communicate these policies to IoT adopters. The informative references for this IoTSRM2 control are [28,30]; [40]; [4; 5; 7; 41; 42; 43; 44]; [46]: TSP-04; [47,48]; [50]: 2.4.3.4, 2.4.3.5, 2.4.3.6, 2.4.8.10; [51]: Principle 1: Key concept 1, Principle 1: Key concept 2; [55]: PS-18; [56]; [57]: GP 3, GP 5; [61]. **Privacy policy (G.V.A.2):** An organization-wide privacy policy, which is aligned with and part of wider overarching data protection policy, is documented, formally approved, published, periodically reviewed, up-to-date, and well communicated. This policy is revised to incorporate IoT privacy requirements for personal data at rest, in transit, and in use. The organization's IoT suppliers have and maintain general privacy policies along with relevant privacy supplements for each IoT product and/or service they provide, and they communicate these policies to IoT adopters. The informative references for this IoTSRM2 control are [28,30]; [40]: 20, 22, 24, 25, 32, 35, 36; [42; 43; 44; 47; 50]: 2.4.12.5; [53]: 4.2.3; [54]: 55: PS-06; [57]: GP 10; [61]. **Vulnerability disclosure policy (G.V.A.3):** The organization's IoT suppliers have vulnerability disclosure policies that are clearly documented, publicly available, periodically reviewed, up-to-date, and well communicated. These policies are aligned with and part of the vulnerability disclosure program. The informative references for this IoTSRM2 control are [28,30,42]; [46]: SDV-05; [49]; [50]: 2.4.3.11, 2.4.3.12, 2.4.3.13, 2.4.3.14, 2.4.3.16, 2.4.3.17; [53]: 4.2.6; [59; 60; 61]. **End-of-Life policy (G.V.A.4):** The organization's IoT suppliers have End-of-Life policies that are published, easily accessible, periodically reviewed, up-to-date, and well communicated to IoT adopters. These policies are aligned with and part of wider product and/or service lifecycle management strategies. The informative references for this IoTSRM2 control are [26,28,30]; [40]: 1, 21; [42]; [46]: EOL-01; [49]; [50]: 2.4.5.22, 2.4.5.35; [53]: 4.2.2, 4.2.5; [54; 61]. **Structures and responsibilities (G.V.B)** The \"Structures and responsibilities\" objective has two IoTSRM2 controls. **IoT security governance structures and responsibilities (G.V.B.1):** IoT security governance structures and responsibilities across and within the three lines of defense (3 LoD) are clearly articulated, documented, board-approved, periodically reviewed, and up-to-date as part of the IoT security risk management program and wider cybersecurity risk management program.