# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 2 Materials and Methods
### Methodology for Developing the IoTSRM2  
This subsection describes our methodology used for developing the proposed IoT Security Risk Management Strategy Reference Model (IoTSRM2). Figure 2 shows our proposed three-phased methodology that consists of nine steps and outputs, namely three steps with associated outputs for each of the three phases (i.e., scoping, analysis, and creation). Figure 2: Our proposed three-phased methodology for developing IoTSRM2. Furthermore, each of the three phases of our proposed methodology together with its corresponding steps are described below. **PHASE 1 SCOping**  
The scoping phase involves the definition of methodology objectives, assumptions, and limitations (Step 1.1), the establishment of focus domains for IoTSRM2 (Step 1.2), and the determination of the in-scope NIST Cybersecurity Framework (CSF) Subcategories (Step 1.3). **Step 1.1 Define methodology objectives, assumptions, and limitations**  
First, this step outlines the ten objectives of the proposed methodology. Thus, the main objectives of the proposed methodology are:  
* **Objective 1:** Develop a reference model for IoT security risk management strategy applicable to IoT adopters from any sector;
* **Objective 2:** Develop the proposed reference model based on NIST CSF [70] and selected IoT security best practices (see Section 2.1). Then, to ensure a comprehensive characterization of the granularity of the proposed reference model, the remaining objectives are designed to address both dimensions (i.e., structural granularity and information granularity) of the classification framework for model granularity developed by [PERSON] et al. [71]. In terms of the structural granularity dimension, the objective of the proposed methodology is:
* **Objective 3:** Organize the proposed reference model in hierarchical structures, including domain level, objective level, and control level. As for the information granularity dimension, the objectives of the proposed methodology are:
* **Objective 4:** Identify IoT security domains to group IoT security objectives for the proposed reference model;
* **Objective 5:** Define high-level IoT security objectives to group IoT security controls for the proposed reference model;
* **Objective 6:** Define the criteria for selecting IoT security requirements from selected IoT security best practices;
* **Objective 7:** Define IoT security controls for the proposed IoT security objectives based on selected IoT security requirements from the in-scope IoT security best practices;
* **Objective 8:** Describe the proposed IoT security controls for IoT adopters using the following levels of detail: expected IoT security related activities/actions from IoT adopters, integration points for expected IoT security related activities/actions with the cybersecurity programs of IoT adopters, and IoT security related activities/actions of IoT suppliers that govern their postmarket activities and that IoT adopters should expect from them;
* **Objective 9:** Provide informative references for each of the proposed IoT security controls, and indicate those informative references that are considered the most relevant to IoT security risk management strategy;
* **Objective 10:** Provide the prioritization rating for each of the proposed IoT security controls. Furthermore, this step provides the assumptions on which the proposed methodology is based. These assumptions are listed below:
* The cybersecurity risk management practices of IoT adopters prior to their IoT adoption and irrespective of their IoT security practices, are assumed to be agile and risk-informed, namely appraised at Tier 4 (Adaptive) of NIST CSF's Tiers [70];
* IoT adopters are assumed to outsource IoT software development and not engage in in-house IoT software development activities;
* IoT adopters are assumed to have contracted IoT suppliers and conducted third-party IoT security due diligence reviews covering premarket IoT security related activities ahead of contracting IoT suppliers.