# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 2 Materials and Methods
### Overview of IoT Security Best Practices
#### 2.1.2 General IoT Security Best Practices  
This subsubsection provides an overview of the selected IoT security best practices which are general in nature in terms of their applicability. Each of these best practices is outlined below under its corresponding type-based category (i.e., codes of practice, guidelines, frameworks). **General IoT Security Codes of Practice**  
The selected general IoT security codes of practice focus on secure IoT systems development lifecycle [51, 59], and are outlined below:  
* **U.S. DHS's Strategic Principles for Securing the Internet of Things (IoT) Version 1.0:** Provides six strategic non-binding principles with suggested practices for each principle to support secure IoT systems development lifecycle [59]. These principles focus on four categories of IoT stakeholders (i.e., IoT developers, IoT manufacturers, service providers, and industrial and business-level consumers) [59]. [PERSON] et al. [18] describe this code of practice in a similar manner, and ECSO [24] also provides a concise description covering the focus of this code of practice;
* **Japan's IoTAC IoT Security Guidelines Ver. 1.0:** It is twofold: firstly, it outlines 21 key concepts spread across five guiding principles for IoT security measures, where each principle corresponds to one stage of the IoT systems development lifecycle (i.e., policy, analysis, design, implementation and connection, and operation and maintenance), and, secondly, it provides four IoT security recommendations to raise awareness among the general public on how to use IoT devices safely. In addition, it provides the mapping of target users (i.e., executives, IoT device manufacturers, system and service providers/corporate users) against key concepts, along with the mapping of general public to recommendations [51]. **General IoT Security Guidelines**  
All reviewed general IoT security guidelines are published by ENISA. Two of these are applicable to sector-specific organizations [28, 55], one guideline focuses on secure IoT systems development lifecycle [56], and another one focuses on secure IoT supply chain [58]. These general IoT security guidelines are outlined below:  
* **ENISA's Baseline Security Recommendations for IoT in the Context of Critical Information Infrastructures:** This report focuses on critical information infrastructures (CII) and applies to IoT adopters, IoT manufacturers and operators, specific IT person nel profiles (e.g., IoT experts, IT/security solutions architects), and regulators. First, it provides an IoT high-level reference model, IoT asset, and threat taxonomies, and mapping of identified IoT threats against the IoT assets. Then, it provides a set of IoT security measures/good practices which are grouped into three categories (i.e., policies, organizational, people and process measures, and technical measures), to address the identified IoT threats, vulnerabilities, and risks. Furthermore, it provides an IoT security gap analysis and seven recommendations that aim to address the identified IoT security gaps. In addition, it provides references for each recommended security measure/good practice, mapping of security measures to threat groups, and the target audience for each of the seven recommendations [28];
* **ENISA's Good Practices for Security of Internet of Things in the Context of Smart Manufacturing:** This study focuses on Smart Manufacturing organizations and applies to operators, manufacturers, and users of Industrial Internet of Things (IIoT). First, it provides a high-level reference model for a smart manufacturing environment, asset and threat taxonomies for Industry 4.0, and mapping of the identified IIoT threats against IIoT assets. Then, it provides a set of security measures/good practices which are grouped into three categories (i.e., policies, organizational practices, and technical practices), to address the identified threats for IIoT environments.