# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 4 Related Work
Regarding the seven selected IoT security best practices that focused on strategic IoT security activities, AgeLight LLC [40], DHS [59], NEMA [52], and OTA [54] provided strategic IoT security principles, ENISA [57] provided strategic guidelines specifically focused on procurement in hospitals, IoTAC [51] provided basic strategic guidance for providers and users of IoT devices, systems, and services across industries, and NIST [53] provided premarket and postmarket cybersecurity activities with a strategic focus for IoT device manufacturers. Similar to these seven selected IoT security best practices which provided IoT security requirements with a strategic focus, our proposed IoTSRM2 provides domains, objectives, and controls focused on strategic IoT security practices. Comparedwith the seven selected IoT security best practices which were not exclusively focused on IoT security risk management strategy, this article proposes a reference model for IoT security risk management strategy (i.e., IoTSRM2) applicable to IoT adopters from any sector. Furthermore, from the perspective of the extent of applicability to this evaluation criterion, compared with the ten selected IoT security best practices (i.e., [28; 42; 44; 45; 56; 58; 60; 61]), which, besides the strategic IoT security practices focused on some technical IoT security practices, our proposed IoTSRM2 exclusively focused on strategic IoT security practices. **E2: Methodology for developing the recommended IoT security requirements/controls is clearly described** \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Evaluation Criterion**} & \multicolumn{3}{c}{**Extent of Applicability**} \\ \cline{2-4}  & **The Evaluation Criterion** & **The Evaluation Criterion Applies** & **The “as-is” Evaluation** \\  & **Fully Applies** & **to a Certain Extent, But Not Fully** & **Criterion Does Not Apply** \\ \hline E1: Focus on strategic IoT security practices over technical IoT security practices & [40; 51; 52; 53; 54; 57; 59], IoTSRM2 & [28; 42; 44; 45; 48; 55; 56; 58; 60; 61] & [26; 30; 41; 43; 46; 47; 49; 50] \\ \hline E2: Methodology for developing the recommended IoT security requirements/controls is clearly described & [26; 28; 41; 55; 56; 57; 58], IoTSRM2 & [30; 40; 43; 61] & [42; 44; 59; 54; 59; 60] \\ \hline E3: Mapping of IoT security requirements/controls to NIST CSF’s Categories and subcategories & IoTSRM2, but none of the 25 selected IoT security practices & [28; 40] & All 25 selected IoT security best practices except [28; 40] \\ \hline E4: Clearly indicate for each IoT security requirement/control expected IoT security actions/activities from IoT suppliers of the target audience & & & \\ \hline E5: Provides integration points with the cybersecurity program as part of each IoT security requirement/control & IoTSRM2, but none of the 25 selected IoT security practices & [45; 55; 56; 57] & All 25 selected IoT security best practices except \\ \hline E6: Mapping of relevant IoT security security best practices with unique identifiers for selected best practices to each recommended IoT security requirement/control & [26; 61], IoTSRM2 & [28; 40; 46; 50; 51; 52; 53; 55; 56; 58; 60] & [30; 41; 42; 43; 47; 49; 54; 57; 59] \\ \hline E7: Prioritization of the recommended IoT security requirements/controls & [42; 49; 61], IoTSRM2 & [40; 47; 50; 54] & All 25 selected IoT security best practices except \\ \hline E8: Provides statistics for the mapping of selected informative references & [61], IoTSRM2 & None of the 25 selected IoT security best practices & All 25 selected IoT security best practices except [61] \\ \hline \hline \end{tabular}
\end{table} 
Table 10: IoTSRM2 and related work mapped to evaluation criteria and extent of applicability. Our proposed methodology for developing IoTSRM2 controls is clearly described.