# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 2 Materials and Methods
### Overview of IoT Security Best Practices
#### 2.1.3 Manufacturer Specific IoT Security Best Practices  
This subsubsection provides an overview of the selected manufacturer specific IoT security best practices. Each of these best practices is outlined below under its corresponding type-based category (i.e., standards, guidelines).  
**Manufacturer Specific IoT Security Standards**  
The selected manufacturer specific IoT security standards are outlined below:  
* **ETSI European Standard (EN) 303.645 V2.1.1 Cyber Security for Consumer Internet of Things: Baseline Requirements:** This standard [30] consists of outcome-focused provisions (i.e., security and data protection) for developers and manufacturers to secure consumer IoT devices [68]. In addition, these provisions address constrained IoT devices. In addition, this standard provides a list of informative references [30];
* **NEMA's Cyber Hygiene Best Practices:** This standard provides cybersecurity principles for electrical equipment and medical imaging manufacturers that may be implemented in the manufacturing facilities and engineering processes of most manufacturing environments. In addition, for each recommended cybersecurity principle, it provides identification of threats and an analysis of their implications along with reference documents [52].  
**Manufacturer Specific IoT Security Guidelines**  
All selected manufacturer specific IoT security guidelines provide manufacturers with security recommendations [43; 53], baseline capabilities [26], and principles for IoT devices [49]. The selected guidelines are outlined below:  
* **BITAG's Internet of Things (IoT) Security and Privacy Recommendations:** This report [43] addresses security and privacy issues of IoT devices [18], and it provides manufacturers with ten actionable security and privacy recommendations focused on consumer IoT devices [49]. ECSO [24] also provides a brief description around the focus of this guideline;
* **CSDE's The C2 Consensus on IoT Device Security Baseline Capabilities:** Provides manufacturers with thirteen industry consensus security baseline capabilities for IoT devices. Besides these security baseline capabilities, this guideline provides as part of annexes some security capabilities envisaged to become baseline, along with other IoT device security capabilities and practices that are not universally applicable across the IoT ecosystem. Moreover, it enumerates informative references and provides several annexes that map each of the recommended IoT security capabilities against the security requirements of several IoT security best practices (e.g., [28; 30; 61]) [26];* **IEEE's Internet of Things (IoT) Security Best Practices:** This report provides IoT manufacturers with eleven prioritized IoT security recommendations for the manufacturing design phase of IoT products. These recommendations are grouped into three categories: securing devices, securing networks, and securing the overall system [49];
* **NIST's Foundational Cybersecurity Activities for IoT Device Manufacturers:** Covers six cybersecurity activities for IoT device manufacturers which are split into two categories: activities related to the premarket phase of IoT devices and activities related to the postmarket phase of IoT devices. For each recommended cybersecurity activity, it provides a list with examples of questions to assist IoT manufacturers as a starting point in achieving the corresponding activity [53].