# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 3 Results
### Our Proposed IoTSRM2
**Asset Management (AM)**  
The \"Asset Management\" domain of IoTSRM2 comprises the following two objectives:  
* Hardware inventory (AM.A): Determine whether IoT hardware assets are inventoried;
* Software inventory (AM.B): Determine whether IoT software assets are inventoried. _Hardware Inventory (AM.A)_  
The \"Hardware inventory\" objective has one IoTSRM2 control, namely \"IoT hardware assets inventory\" control. **IoT hardware assets inventory (AM.A.1):** IoT devices and their hardware components are discovered, inventoried, assigned owners, classified, and tracked throughout their lifecycles using a centralized, formally approved, periodically reviewed, and up-to-date IT inventory which is synchronized with the configuration management database (CMDB) that feeds the organization's data warehouse. The activities of discovering, inventory, and tracking IoT hardware assets are aligned with and part of wider IoT hardware asset management and IT asset management processes. The organization's IoT suppliers manage their hardware assets across their lifecycles and provide cybersecurity bills of materials (CBOMs) to IoT adopters for the IoT products they acquire. The informative references for this IoTSRM2 control are [30]; [40]: 12; [44; 45]; [46]: ACT-01, ACT-03, ACT-04, ACT-05, GVN-01, OPA-01, TSP-02; [53]: 4.2.3, 4.2.6; [54]; [55]: PS-11, PS-12, PS-14; [57]: GP 28; [58; 59]. _Software inventory (AM.B)_  
The \"Software inventory\" objective has one IoTSRM2 control, namely \"IoT software assets inventory\" control. **IoT software assets inventory (AM.B.1):** All software assets relevant to IoT devices and/or services are discovered, inventoried, assigned owners, classified, and tracked throughout their lifecycles using a centralized, formally approved, periodically reviewed, and up-to-date IT inventory which is synchronized with the configuration management database (CMDB) that feeds the organization's data warehouse. The activities of discovering, inventory, and tracking IoT software assets are aligned with and part of wider IoT software asset management and IT asset management processes. The organization's IoT suppliers manage their software assets across their lifecycles and provide cybersecurity bills of materials (CBOMs) to IoT adopters for acquired IoT products. The informative references for this IoTSRM2 control are [40]: 12; [44]; [46]: ACT-01, ACT-03, ACT-05, GVN-01, TSP-02; [51]: Principle 2: Key concept 3; [53]: 4.2.3, 4.2.6; [54]; [55]: PS-11, PS-12, PS-14; [57]: GP 28; [58; 59]. Then, for each IoTSRM2 objective of the \"Asset Management\" domain, Table 4 provides the unique identifier of the in-scope NIST CSF Subcategory and the associated IoTSRM2 control with its adjusted weight. These IoTSRM2 controls are already prioritized within each IoTSRM2 objective given that there is only one control for each objective, and in effect the adjusted weight of each IoTSRM2 control is the same as the weight of the associated IoTSRM2 objective. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**IoTSRM2 Objective** & **NIST CSF Subcateg. ID** & **IoTSRM2 Control** & **Adjusted Control Weight** \\ \hline \multirow{4}{*}{Supplier assessment (SC.A)} & \multirow{4}{*}{ID.SC-2} & IoT supply chain risk & \multirow{2}{*}{3.90\%} \\  & & management plan (SC.A.1) & \\ \cline{1-1}  & & IoT supply chain risk & \\ \cline{1-1}  & & assessment (SC.A.2) & \\ \hline \multirow{4}{*}{Supplier contract management (SC.B)} & \multirow{4}{*}{ID.SC-3} & IoT trustworthiness & \multirow{2}{*}{4.20\%} \\  & & requirements (SC.B.2) & \\ \cline{1-1}  & & IoT supplier contract & \\ \cline{1-1}  & & management plan (SC.B.1) & \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Prioritized IoTSRM2 controls for each objective of the “Supply Chain Risk Management” domain.