# A Survey on Cyber Risk Management for the Internet of Things
## 5 Cyber Risk Treatment For IoT Survey Results
### IoT Risk Control  
Security controls are the \"means of managing risk\" referring to all mechanisms that can reduce risk, such as good practices, policies, and physical controls [16]. In the case of mitigation, risks need to be treated appropriately by the most suitable yet effective controls which takes further evaluation, implementation, and prioritisation [15]. IoT Cyber risk management frameworks must contain a phase that forms strategies to combat risk, for example \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & \multicolumn{4}{c}{**IoT Risk Control**} & \multicolumn{2}{c}{**IoT Risk Monitoring**} \\ \cline{2-7}
**Reference** & **IoT Control** & **IoT Security** & **IoT Risk** & **Optimise IoT** & **Continuous** & **Residual** \\  & **Strategies** & **Requirements** & **Resources** & **Control Strategies** & **Monitoring** & **IoT Risk** \\ \hline [PERSON] et al. [38] & ✓ & ✓ & - & - & ✓ & - \\ [PERSON] et al. [39] & - & - & - & - & - & - \\ [PERSON] et al. [40] & ✓ & - & ✓ & - & ✓ & ✓ \\ [PERSON] and [PERSON] [41] & ✓ & ✓ & - & - & - & - \\ [PERSON] et al. [42] & - & - & - & - & - & - \\ [PERSON] et al. [43] & ✓ & - & - & - & - & - \\ [PERSON] et al. [44] & ✓ & ✓ & ✓ & - & ✓ & ✓ \\ [PERSON] et al. [45] & ✓ & - & - & ✓ & ✓ & ✓ \\ [PERSON] et al. [46] & ✓ & ✓ & - & ✓ & ✓ & - \\ [PERSON] et al. [47] & ✓ & ✓ & - & - & ✓ & - \\ [PERSON] et al. [18] & ✓ & ✓ & - & - & - & - \\ [PERSON] et al. [49] & ✓ & - & - & ✓ & - & - \\ [PERSON] et al. [50] & - & - & - & - & - & - \\ [PERSON] et al. [51] & ✓ & ✓ & - & - & ✓ & - \\ [PERSON] et al. [52] & - & - & - & - & ✓ & - \\ [PERSON] and [PERSON] [53] & ✓ & - & - & ✓ & - & - \\ [PERSON] and [PERSON] [54] & ✓ & ✓ & ✓ & - & - & - \\ [PERSON] et al. [55] & ✓ & ✓ & ✓ & ✓ & - & - \\ [PERSON] [56] & ✓ & ✓ & - & - & - & - \\ [PERSON] [57] & ✓ & ✓ & ✓ & - & - & - \\ [PERSON] et al. [58] & - & - & - & - & ✓ & ✓ \\ [PERSON] et al. [59] & - & - & - & - & ✓ & - \\ [PERSON] et al. [60] & - & ✓ & - & ✓ & ✓ & - \\ [PERSON] and [PERSON] [61] & - & - & - & - & - & - \\ [PERSON] et al. [62] & ✓ & ✓ & - & - & - & - \\ [PERSON] et al. [63] & ✓ & ✓ & - & - & - & - \\ [PERSON] and [PERSON] [64] & ✓ & ✓ & - & ✓ & - & - \\ [PERSON] et al. [65] & ✓ & ✓ & - & - & - & - \\ [PERSON] et al. [66] & ✓ & ✓ & - & - & - & - \\ [PERSON] et al. [67] & ✓ & - & ✓ & ✓ & - & - \\ [PERSON] et al. [68] & ✓ & ✓ & - & ✓ & ✓ & ✓ \\ [PERSON] et al. [69] & - & - & - & - & ✓ & ✓ \\ [PERSON] et al. [70] & ✓ & ✓ & - & - & ✓ & - \\ [PERSON] et al. [71] & - & - & - & - & - & - \\ [PERSON] et al. [72] & ✓ & ✓ & ✓ & - & - & - \\ [PERSON] et al. [73] & ✓ & ✓ & - & - & - & - \\ [PERSON] et al. [74] & ✓ & - & - & ✓ & ✓ & - \\ [PERSON] et al. [75] & ✓ & ✓ & - & - & - & - \\ [PERSON] and [PERSON] [76] & ✓ & ✓ & - & - & ✓ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 2: A breakdown of the various papers showing elements of IoT risk control and IoT risk monitoring. A tick symbol (✓) represents a paper’s inclusion to a category, while a dash symbol (-) represents a paper that is non-applicable to a category. a risk mitigation phase where risk assessment results are evaluated and security controls or risk response are applied to reduce risk to an acceptable level [38; 40; 60; 74; 76]. On a surface level, implementing IoT control strategies based on the prioritisation of critical risks is a simple view of combating risk in an effective way, for example, the elimination of the top five most critical IoT vulnerabilities [55] or use of NIST's frameworks [44]. IoT risk assessment results show critical areas of concern that should be responded to [43] and security controls can be used to ensure that security requirements are achieved [64; 65]. For [PERSON] et al. [72] vulnerabilities that can impact IoT data are assessed, with risk control focusing on whether vulnerabilities are controlled and if IoT data is secure. However, the effectiveness of an IoT security control also needs to be considered, For example [PERSON] et al.