# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 3 Results
### Our Proposed IoTSRM2
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**IoTSRM2 Objective** & **NIST CSF Subcateg. ID** & **IoTSRM2 Control** & **Adjusted Control Weight** \\ \hline \multirow{4}{*}{Security related policies (GV.A)} & \multirow{4}{*}{ID.GV-1} & IoT security policy (GV.A.1) & 2.20\% \\  & & Privacy policy (GV.A.2) & 1.67\% \\  & & Vulnerability disclosure policy & 1.23\% \\  & & (GV.A.3) & \\  & & End-of-Life policy (GV.A.4) & 1.15\% \\ \hline \multirow{4}{*}{Structures and responsibilities (GV.B)} & \multirow{4}{*}{ID.GV-2} & IoT security governance structures and responsibilities (GV.B.1) & 3.29\% \\  & & IoT security operations roles and responsibilities (GV.B.2) & 2.96\% \\ \hline \multirow{4}{*}{Regulatory requirements (GV.C)} & \multirow{4}{*}{ID.GV-3} & Cybersecurity regulatory framework (GV.C.1) & 6.25\% \\ \hline \multirow{4}{*}{Goverance and risk management plans (GV.D)} & \multirow{4}{*}{ID.GV-4} & IoT security and privacy controls management plan (GV.D.1) & 2.14\% \\  & & IoT security training and awareness & 0.96\% \\  & & plan (GV.D.4) & 0.89\% \\  & & IoT vulnerability management & 0.89\% \\  & & plan (GV.D.6) & 0.67\% \\  & & IoT security budget plan (GV.D.2) & 0.67\% \\  & & IoT End-of-Life plan (GV.D.7) & 0.63\% \\  & & IoT security incident response & 0.62\% \\  & & plan (GV.D.5) & \\  & & IoT security measurement and & \\  & & reporting plan (GV.D.3) & 0.35\% \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Prioritized IoTSRM2 controls for each objective of the “Goverance” domain. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**IoTSRM2 Objective** & **NIST CSF Subcateg. ID** & **IoTSRM2 Control** & **Adjusted Control Weight** \\ \hline \multirow{4}{*}{Vulnerability discovery (RA.A)} & \multirow{4}{*}{ID.RA-1} & Assessment-based IoT vulnerability discovery (RA.A.2) & 4.56\% \\  & & Disclosure-based IoT vulnerability discovery (RA.A.1) & 1.69\% \\ \hline \multirow{4}{*}{Threat identification (RA.B)} & \multirow{4}{*}{ID.RA-3} & Assessment-based IoT threat identification (RA.B.2) & 4.62\% \\  & & Intelligence-driven IoT threat identification (RA.B.1) & 1.63\% \\ \hline Risk analysis (RA.C) & \multirow{2}{*}{ID.RA-4} & IoT risk identification and analysis (RA.C.1) & 6.25\% \\ \cline{1-1} \cline{2-4}  & & & \\ \cline{1-1} \cline{2-4}  & & & \\ \cline{1-1} \cline{2-4}  & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Prioritized IoTSRM2 controls for each objective of the “Risk Assessment” domain. \begin{table}
\begin{tabular}{c c c} \hline \hline
**IoTSRM2 Objective** & **NIST CSF Subcateg. ID** & **IoTSRM2 Control** & **Adjusted Control Weight** \\ \hline \multirow{4}{*}{Security policies (GV.A)} & \multirow{4}{*}{ID.GV-1} & IoT security policy (GV.A.1) & 2.20\% \\  & & Privacy policy (GV.A.2) & 1.67\% \\  & & Vulnerability disclosure policy & 1.23\% \\  & & (GV.A.3) & \\  & & End-of-Life policy (GV.A.4) & 1.15\% \\ \hline \multirow{4}{*}{Structures and responsibilities (GV.B)} & \multirow{4}{*}{ID.GV-2} & IoT security governance structures and responsibilities (GV.B.1) & 3.29\% \\  & & IoT security operations roles and responsibilities (GV.B.2) & 2.96\% \\ \hline \multirow{4}{*}{Regulatory requirements (GV.C)} & \multirow{4}{*}{ID.GV-3} & Cybersecurity regulatory framework (GV.C.1) & 6.25\% \\ \cline{1-1} \cline{2-4}  & & IoT security and privacy controls management plan (GV.D.1) & 2.14\% \\ \cline{1-1}  & & IoT security training and awareness & 0.96\% \\ \cline{1-1}  & & IoT vulnerability management plan (GV.D.6) & 0.89\% \\ \cline{1-1}  & & IoT security budget plan (GV.D.2) & 0.67\% \\ \cline{1-1}  & & IoT End-of-Life plan (GV.D.7) & 0.63\% \\ \cline{1-1}  & & IoT security incident response plan (GV.D.5) & 0.62\% \\ \cline{1-1}  & & IoT security measurement and reporting plan (GV.D.3) & 0.35\% \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Prioritized IoTSRM2 controls for each objective of the “Risk Management Strategy” domain. A consolidated view of IoTSRM2 controls with informative references is provided in Appendix A as part of Table A1.