# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 2 Materials and Methods
### Overview of IoT Security Best Practices
As for the next level of the taxonomic hierarchy, the selected IoT security best practices are grouped into the four categories below based on their corresponding type:
* **Codes of practice:** this category denotes IoT security voluntary principles [42] or guidelines [61] recommended by governments for industry as the minimum standard for a specific topic [42], which do not take precedence over national legislation in any country [62];
* **Standards:** this category denotes agreed IoT security best practices developed by external standards organizations which consist of requirements, specifications, guidelines, or characteristics for activities or for their outputs, that are generally complied with for making a product, managing a process, delivering a service, or supplying materials [4];
* **Guidelines:** this category denotes IoT security recommendations on how something should be done for achieving an objective [63], and these recommendations are less prescriptive than procedures [64];
* **Frameworks:** this category denotes logical structures or models that rely on a set of guiding principles, may not get into the detailed processes and procedures, may refer to a collection of standards and best practices (e.g., methodologies, methods, etc.) that underpin their underlying principles, and are aimed at enabling IoT security programs [4]. \begin{table}
\begin{tabular}{l l l} \hline \hline \multicolumn{1}{c}{**Publisher**} & \multicolumn{1}{c}{**Name**} & \multicolumn{1}{c}{**Reference**} \\ \hline The European Union Agency for & Baseline Security Recommendations for IoT in the & \\ Cybersecurity (ENISA) & context of Critical Information Infrastructures & [28] \\ \hline The European Union Agency for & Good Practices for Security of Internet of Things in & [55] \\ Cybersecurity (ENISA) & the context of Smart Manufacturing & \\ \hline The European Union Agency for & Good Practices for Security of IoT Secure Software & [56] \\ Cybersecurity (ENISA) & Development Lifecycle & \\ \hline The European Union Agency for & Procurement Guidelines for Cybersecurity in & \\ Cybersecurity (ENISA) & Hospitals Good practices for the security of & [57] \\ \hline The European Union Agency for & Guidelines for Securing the Internet of Things Secure & \\ Cybersecurity (ENISA) & supply chain for IoT & [58] \\ \hline U.S. Department of Homeland Security (DHS) & Strategic Principles for Securing the Internet of & \\  & Things (IoT) Version 1.0 & [59] \\ \hline U.S. Department of Transportation National & & \\ Highway Traffic Safety Administration (NHTSA) & Cybersecurity Best Practices for Modern Vehicles & [60] \\ \hline United Kingdom Department for Digital, & & \\ Culture, Media and Sport (UK DCMS) & Code of Practice for Consumer IoT Security & [61] \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._Furthermore, Table 2 shows the references of the reviewed IoT security best practices mapped against the corresponding categories of IoT security best practices from the proposed taxonomic hierarchy. Furthermore, an overview of these IoT security best practices is provided under individual subsubsections that correspond to the four categories of IoT security best practices based on their applicability to specific groups of target audience. As part of each subsubsection, the corresponding IoT security best practices are outlined under their corresponding category based on the type of IoT security best practice.