# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 3 Results
### Our Proposed IoTSRM2
Hence, for \"Vulnerability discovery\", \"Threat identification\", \"Risk analysis\", and \"Risk responses\", the most important IoTSRM2 controls based on adjusted weights are \"Assessment-based IoT vulnerability discovery\", \"Assessment-based IoT threat identification\", \"IoT risk identification and analysis\", and \"Cybersecurity risk register and IoT risk responses\", respectively. **Risk Management Strategy (RM)**  
The \"Risk Management Strategy\" domain of IoTSRM2 consists of the following two objectives:  
* Risk appetite and tolerances (RM.A): Determine whether IoT security risk appetite and tolerances are determined and clearly expressed;
* Context-informed risk tolerances (RM.B): Determine whether IoT security risk tolerances are informed by the entity's role in critical infrastructure and sector specific risk analysis. _Risk appetite and tolerances (RM.A)_  
The \"Risk appetite and tolerances\" objective has one IoTSRM2 control, namely \"IoT security risk appetite and tolerances\" control. **IoT security risk appetite and tolerances (RM.A.1):** IoT security risk appetite and associated range of risk tolerances are clearly articulated and documented as part of board approved, periodically reviewed, and up-to-date IoT security risk appetite and tolerance statements. These statements are defined based on IoT security and cybersecurity risk management best practices, are in line with the organization's appetites and tolerances for cybersecurity and privacy risks, support the objectives of the organization's risk management strategy, and trigger re-assessments of cybersecurity and privacy risk appetites and tolerances. The organization's IoT suppliers clearly articulate and document their appetites and associated tolerances for cybersecurity, privacy, and IoT security risks, and communicate their risk appetite and tolerance statements to IoT adopters. The informative references for this IoTSRM2 control are [46]: RSM-01; [48]; [50]: 2.4.3.4; [52; 54]; PS-18. _Context-informed risk tolerances (RM.B)_  
The \"Context-informed risk tolerances\" objective has one IoTSRM2 control, namely \"Context-informed IoT security risk tolerances\" control. **Context-informed IoT security risk tolerances (RM.B.1):** IoT security risk tolerance determination leverages a clear understanding of the criticality of the organization's infrastructure and the associated interdependencies with critical infrastructure, along with the organization's awareness of the risk profile for the sector in which it operates. These IoT risk tolerances are aligned with the organization's appetites for IoT security, privacy, and cybersecurity risks. The organization's IoT suppliers know their roles in critical infrastructure, clearly articulate and document their tolerances for cybersecurity, privacy, and IoT security risks, and communicate their risk appetite and tolerance statements to IoT adopters. The informative references for this IoTSRM2 control are [46]: RSM-01; [48]; [50]: 2.4.3.4; [52]; [53]: 4.2.1; [55]: PS-18. Then, for each IoTSRM2 objective of the \"Risk Management Strategy\" domain, Table 8 provides the unique identifier of the in-scope NIST CSF Subcategory and the associated IoTSRM2 control with its adjusted weight. These IoTSRM2 controls are already prioritized within each IoTSRM2 objective given that there is only one control for each objective, and in effect the adjusted weight of each IoTSRM2 control is the same as the weight of the associated IoTSRM2 objective. **Supply Chain Risk Management (SC)**  
The \"Supply Chain Risk Management\" domain of IoTSRM2 consists of the following two objectives:  
* Supplier assessment (SC.A): Determine whether IoT suppliers across supply chain tiers are identified, risk assessed, and prioritized following the IoT supply chain risk management plan;
* Supplier contract management (SC.B): Determine whether IoT supplier contract requirements are defined following the IoT supplier contract management plan. _Supplier assessment (SC.A)_  
The \"Supplier assessment\" objective has two IoTSRM2 controls.