# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
###### Abstract
For instance, [PERSON] [12] highlighted the findings of a recent survey that revealed that very few of the survey participants had a cybersecurity strategy in place that incorporates IoT security requirements. The lack of cybersecurity strategies that cover IoT was also pointed out by McKinsey & Company for a fairly considerable number of organizations [13]. Considering this prevalent absence of robust IoT security risk management strategies in organizations coupled with the paucity of IoT security risk management strategy reference sources, there is a clear research gap in terms of the existence of an IoT security risk management strategy reference model. Thus, the purpose of this research article is to propose an IoT security risk management strategy reference model (IoTSRM2) that aims to support practitioners from organizations embracing IoT technologies to formulate or reframe their IoT security risk management strategies and achieve secure IoT adoption. Moreover, the proposed IoTSRM2 aims to support fellow researchers from academia that seek to explore the topic of IoT security risk management strategy as part of their research works. To address the aforementioned research gap and achieve the desired IoTSRM2, this article relies on a mixed methods research methodology harnessing both qualitative and quantitative methods. Hence, this research work makes use of quantitative data to complement the qualitative data, which adds value to the outputs of this research and allows the proposed IoTSRM2 to become more actionable through a means for prioritization of IoTSRM2 controls. In this context, the outputs of this research work concretize into the main contributions outlined below:  
* The development of a taxonomic hierarchy for classifying IoT security best practices based on their applicability to specific groups of target audience and type of IoT security best practice;
* The identification of some of the most well-renowned IoT security best practices, the classification of these best practices based on the proposed taxonomic hierarchy, and the summarization of these best practices;
* The design of a methodology for developing the IoT security risk management strategy reference model;
* The development of a reference model for IoT security risk management strategy based on best practices that is suitable for IoT adopters from any sector;* A critical evaluation of some of the IoT security best practices based on their linkage to the proposed reference model;
* A comparative analysis of the related work for the proposed reference model based on a set of evaluation criteria. Beyond this introductory section, the remainder of this article is organized as follows. Section 2 provides an overview of IoT security best practices and describes the three-phased methodology for developing the proposed IoT security risk management strategy reference model (IoTSRM2). Section 3 first presents the proposed IoTSRM2 including the IoTSRM2 domains, objectives, and controls, the informative references for each IoTSRM2 control, and the prioritization of IoTSRM2 controls for each IoTSRM2 objective. Then, Section 3 provides the critical evaluation of selected informative references of IoTSRM2. Section 4 presents the related work. Finally, Section 5 presents the concluding remarks and future work.