# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 4 Related Work  
A sizeable number of best practices and academic papers has been published on IoT security; however, the majority of these are more technical in nature (e.g., [26; 30; 43; 74; 75]). Moreover, at the time of writing, there is no research article nor best practice to exclusively focus on IoT security risk management strategy. In this context, [PERSON] [12] proposed a four-layer IoT cyber risk management framework, which includes the IoT cyber ecosystem layer, the IoT cyber infrastructure layer, the IoT cyber risk assessment layer, and the IoT cyber performance layer. Nevertheless, the IoT cyber risk management framework proposed by [PERSON] [12] outlines the framework's layers instead of providing IoT security controls/requirements, is not exclusively focused on IoT security risk management strategy, and it is based on cybersecurity risk management practices rather than IoT security best practices. Thus, compared with the work performed by [PERSON] [12], our proposed IoTSRM2 is exclusively focused on IoT security risk management strategy, is based on 25 selected IoT security best practices, and provides expected IoT security risk management controls, among others. Moreover, some of the previous studies concentrated on the state of the art of IoT security best practices (i.e., [18; 24]) or on delivering an overview and catalogue of key IoT security initiatives [76]. For instance, ECSO [24], [PERSON] et al. [18], and CSA Singapore along with MEAC of the Netherlands [76] provided overviews around IoT security best practices, but they did not clearly link the applicability of each best practice to a specific group of target audience (i.e., adopters, suppliers, manufacturers, general) nor did they classify each best practice based on type (i.e., codes of practice, standards, guidelines, frameworks). Hence, as part of Section 2.1, besides providing an overview of some of the most renowned IoT security best practices, this article proposed a taxonomic hierarchy for classifying best practices based on their applicability and type, and this taxonomy is used for outlining the 25 selected IoT security best practices. Furthermore, the available documentation around the 25 selected IoT security best practices was used to provide the overview of IoT security best practices, our proposed IoTSRM2, and the analysis of IoTSRM2's related work from this section (see Table 10). Then, with respect to the analysis of IoTSRM2's related work, Table 10 shows the IoTSRM2 together with the 25 selected IoT security best practices mapped against the proposed evaluation criteria and the extent of applicability to each evaluation criterion. With respect to the proposed evaluation criteria, eight evaluation criteria were formulated based on our proposed methodology for developing the IoTSRM2 (see Section 2.2). In addition, with respect to the extent of applicability, three types of applicability were considered relevant to indicate differences and/or similarities between the proposed IoTSRM2 and the in-scope research works for this evaluation. Following Table 10, this section presents the evaluation of IoTSRM2 and the 25 selected IoT security best practices for each evaluation criterion. **E1: Focus on strategic IoT security practices over technical IoT security practices**  
Our proposed IoTSRM2 is exclusively focused on IoT security risk management strategy. In addition, from the 25 selected IoT security best practices, seven of them focused on strategic IoT security activities (i.e., [51; 52; 53; 54; 57; 59]), ten of them had a partial focus on strategic IoT security activities (i.e., [28; 42; 44; 45; 48; 55; 56; 58; 60; 61]), while the remaining ones focused on technical IoT security activities (i.e., [26; 30; 41; 43; 46; 47; 49; 50]).