# A Survey on Cyber Risk Management for the Internet of Things
## 6 Recommendations
### Recommendations for IoT Cyber Risk Monitoring  
IoT risk monitoring is a continuous process that allows for risk management processes to use up to date information that maintain acceptable risk levels. Much like IoT risk control, we find that discussions into IoT risk monitoring were limited, and often not part of IoT cyber risk management frameworks. Below, we suggest questions for future works and recommend ways to overcome problems within IoT cyber risk-monitoring processes.  
_How can IoT risk be dynamically monitored?_ Monitoring requires the observation of critical risks to find vulnerabilities that may manifest into threats. Such a process needs to be continuous to ensure that dynamic decisions for IoT control take place when risk becomes unacceptable. IoT risk management does not simply end once controls are implemented since new threats can materialise at a fast pace. In turn, adding a new device or user to a network can drastically change risk due to changes in control and dependencies. Within regulated IoT domains, (such as within organisations, healthcare, smart grids and smart cities), monitoring processes are likely to be easier to implement due to increased access to resources, for example the use of an intrusion detection system that monitors and detects unauthorised IoT system behaviours by users and devices at a network level. However, for smaller IoT domains, such as smart homes, monitoring needs to be easily manageable. By extension, regular users need to understand how to monitor security, in such cases, an IoT cyber risk management application may be helpful. It is notable that user and system behaviours should be monitored to ensure that actions performed are legitimate and that user actions are not of a high risk; however, preventing such risks from occurring will require additional IoT controls.  
_How can residual IoT risk be assessed to ensure risk is at an acceptable level?_ Residual risk is the amount of risk remaining once a set of controls have been implemented. Only a very limited number of works address residual risk, which is curious, as it is an important aspect of risk control. We suggest that future works focus on the consideration of residual risk and identifying the amount of risk remaining to ensure that risk is acceptable, as well as what this means to IoT risk management. This also requires dynamic risk monitoring where an organisation or user can update risk parameters to continuously assess risk, which can easily lead to quick preventive actions being implemented. To gain an accurate view of residual risk, updated risk assessment results are required. Within regulated IoT domains, such as smart grids and healthcare, governing bodies around the globe provide strict work regulations, for example, the Health and Safety Executive (HSE) states that risk assessments should be reviewed when major system changes are made [112]. However, smart homes are not held to the same standard, making acceptable residual risk harder to define due to uncertainty surrounding whether an resident will maintain cyber security controls and cyber hygiene.