# A Survey on Cyber Risk Management for the Internet of Things
## 5 Cyber Risk Treatment For IoT Survey Results
### Risk Monitoring
#### 5.2.2 Calculate Residual IoT Risk  
Residual risk refers to the portion of risk that remains once security measures are implemented [15]. An organisation may assume that implemented security controls will be used to their full potential all the time, which is not always the case; this issue causes risk to be underestimated, for example, the uncertainty for a trained user to still fall for a social engineering attack.  
To combat this problem, [PERSON] et al. [45] identify the amount of risk an organisation cannot control based on the difference between the assets' total risk and the total mitigated risk. In doing this, an organisation can identify the amount of risk that can be controlled and if the level remaining can be deemed as acceptable or if controls need to be adjusted.  
For IoT domains like smart homes, a baseline of risk acceptance needs to be determined. [PERSON] et al. [69] conceptualise this by asking users a series of questions when the proposed risk assessment application is first used. Despite not having a deep analysis of the vulnerabilities, [PERSON] et al. [44] discuss the use of a tool called MAGERIT applied within the context of a smart city. MAGERIT, which focuses on the analysis of assets and control effectiveness, allows for residual risk to be calculated from the remaining impact value when controls are applied.  
Monitoring the remaining risk allows for the anticipation of future attacks that may have been deemed acceptable. [PERSON] et al. [40] utilise residual risks within a risk monitor stage, where risks that are not fully controlled are monitored in case they become worse. Good practices for IoT need to be continuous, with practices such as devices patches and training being updated to remain up to date with future risks. However, some risks may never be fully controlled, as it may not be feasible, resource wise, when considering how much IoT devices cost [40]. Unlike [PERSON] et al. [40], [PERSON] and [PERSON] [76] dedicate a phase to analyse residual risks to ensure that risks are acceptable. The authors assess groups of IoT mitigation controls, like access control mechanisms and cryptography, by mapping controls to risks and the extent to which they do so.  
_Insight 17:_ To further answer RQ4, residual IoT risks show the amount of remaining IoT risk upon the implementation of controls. The number of papers discussing residual risk is limited, which raises questions about how acceptable risk for an IoT domain is determined and how residual risk can be calculated. Despite [PERSON] et al. [69] asking users a series of questions upon the first use of a risk management application to gauge risk, the authors do not explore how these questions lead to the discovery of an acceptable risk threshold and do not provide examples. For the calculation of residual IoT risk, risk assessments could be performed again, or an equation could be used, as within the works of [PERSON] et al. [45] and [PERSON] et al. [44]. The value of residual IoT risk should also be monitored since controls may degrade over time [36].