# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 3 Results
### Our Proposed IoTSRM2
The organization's IoT suppliers have established their cybersecurity governance structures and responsibilities, and they work with IoT adopters to define shared governance structures and responsibilities for cybersecurity risk management. The informative references for this IoTSRM2 control are [46]: GVN-01, UPD-01; [47]; [50]: 2.4.3.1, 2.4.3.2. **IoT security operations roles and responsibilities (G.V.B.2):** IoT security operations roles, responsibilities, and levels of authority within the first line of defense are clearly articulated, documented, formally approved, periodically reviewed, and up-to-date as part of IoT security risk management program and wider cybersecurity risk management program. The organization's IoT suppliers have established cybersecurity operations' roles and responsibilities, dialogue on shared responsibility for IoT security with IoT adopters, and provide points of contact for IoT security incident response and vulnerability disclosure. The informative references for this IoTSRM2 control are [28; 42; 44]; [46]: BCN-01, IMT-02; [47]; [50]: 2.4.3.19, 2.4.3.20, 2.4.3.21, 2.4.12.12; [51]: Principle 5: Key concept 20; [53]: 4.2.1, 4.2.4; [55]: OP-08, OP-11; [56]; [57]: GP 1; [60; 61]. _Regulatory requirements (GV.C)_  
The \"Regulatory requirements\" objective has one IoTSRM2 control, namely \"Cybersecurity regulatory framework\" control. **Cybersecurity regulatory framework (GV.C.1):** A cybersecurity regulatory framework, which captures relevant cybersecurity, data privacy, and IoT security regulatory requirements, is documented, formally approved, periodically reviewed, and up-to-date. This is aligned with and part of wider organization's legal and regulatory framework. The organization's IoT suppliers have and maintain cybersecurity regulatory frameworks which incorporate relevant cybersecurity, data privacy, and IoT security regulatory requirements, and they communicate to IoT adopters about their compliance with applicable legal and regulatory obligations. The informative references for this IoTSRM2 control are [28]; [40]; [31]; [44]; [46]: CLS-04, GVN-02, RSM-01; [47; 48; 54]; [55]: PS-06, TM-07. _Governance and risk management plans (GV.D)_  
The \"Governance and risk management plans\" objective has seven IoTSRM2 controls. **IoT security and privacy controls management plan (GV.D.1):** An organization-wide IoT security and privacy controls management plan, which is aligned with and part of the organization's cybersecurity risk management program, is documented, approved by board committees and/or C-suite executives, periodically reviewed, and up-to-date. The organization's IoT suppliers have and maintain controls management plans for improving their cybersecurity postures, and cybersecurity and privacy controls frameworks that enable secure IoT system development lifecycle. The informative references for this IoTSRM2 control are [28; 30]; [40]; [5; 25; 30]; [42; 44; 45]; [46]: BCN-01, RSM-01, SDV-15, UPD-03; [47; 48]; [50]: 2.4.3.4, 2.4.12.6, 2.4.12.7, 2.4.16.1, 2.4.12.9, 2.4.12.10, 2.4.16.2; [55]: PS-01, PS-06, PS-16, PS-18, PS-20, PS-22, PS-24, OP-03, OP-06, OP-07, OP-09, OP-24, OP-25, TM-12, TM-14, TM-15, TM-16, TM-40, TM-57; [56]; [57]: GP 6; [58; 61]. **IoT security budget plan (GV.D.2):** A budget plan for the IoT security risk management program is documented, approved by board committees and/or C-suite executives, periodically reviewed, and up-to-date. This plan is part of the cybersecurity budget plan and in line with the overall capital planning and investment control process for IT investments. The organization's IoT suppliers have and maintain cybersecurity budget plans for secure IoT system development lifecycle. The informative references for this IoTSRM2 control are [28; 56; 60]. **IoT security measurement and reporting plan (GV.D.3):** IoT security measurement and reporting plan, which is aligned with and part of wider cybersecurity program measurement and reporting, is defined, documented, formally approved, periodically reviewed, and up-to-date.