# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 3 Results
### Our Proposed IoTSRM2
Business Environment (BE)  
The \"Business Environment\" domain of IoTSRM2 consists of the following two objectives:  
* Dependencies and critical functions (BE.A): Determine whether dependencies and critical functions for delivery of critical IoT enabled services are established;
* Critical service resilience (BE.B): Determine whether resilience requirements to support delivery of critical IoT enabled services are established. _Dependencies and critical functions (BEA)_  
The \"Dependencies and critical functions\" objective has one IoTSRM2 control, namely \"Criticality and impact analysis\" control. **Criticality and impact analysis (BE.A.1):** All IoT enabled services (e.g., internal services, customer services) along with the enablers of the organization's IoT infrastructure (e.g., components and subcomponents, business services, IT and OT infrastructure, IoT supply chain) are identified, analyzed, and prioritized based on their relative importance to organizational resilience and stakeholders. These activities of assessing IoT enabled services and enablers are aligned with and part of overarching cybersecurity risk management program. The organization's IoT suppliers undertake regular dependency and criticality analysis that inform their system development lifecycles, and they provide cybersecurity bills of materials (CBOMs) to IoT adopters for the IoT products they acquire. The informative references for this IoTSRM2 control are [28]; [40]: 12, 23, 44; [41]; [46]: GVN-02, SOP-01, SOP-02, TMM-04; [48]; [51]: Principle 2: Key concept 3, Principle 2: Key concept 5, Principle 5: Key concept 19; [53]: 4.2.1, 4.2.3, 4.2.6; [54]; [55]: PS-07, PS-08, PS-19, TM-10, TM-13; [56]; [57]: GP 7, GP 12; [58; 59; 60]. _Critical service resilience (BE.B)_  
The \"Critical service resilience\" objective has one IoTSRM2 control, namely \"Resiliency requirements\" control. **Resiliency requirements (BE.B.1):** Cybersecurity, reliability, continuity, and recovery requirements for critical IoT enabled services across the entire disruption lifecycle, are established, documented, formally approved, periodically reviewed, and up-to-date. These resiliency requirements for all mission critical IoT enabled services derived from criticality and impact analysis are in line with the risk tolerances and established based on applicable regulatory obligations and operational resilience best practices as part of the organization's cybersecurity controls management, cybersecurity incident response, and business continuity and disaster recovery plans. The organization's IoT suppliers have robust system development lifecycles that incorporate resiliency requirements, communicate their cybersecurity incident response, service continuity, and disaster recovery plans to IoT adopters, and provide cybersecurity bills of materials (CBOMs) to IoT adopters for the IoT products they acquire. The informative references for this IoTSRM2 control are [28]; [40]: 12, 23, 44; [44; 45]; [46]: BCN-01; [48]; [50]: 2.4.3.18, 2.4.3.23; [52; 54]; [55]: OP-01, TM-09, TM-12, TM-15, TM-16, TM-17; [56]; [57]: GP 6, GP 17, GP 22, GP 23; [58; 59; 60]. Then, for each IoTSRM2 objective of the \"Business Environment\" domain, Table 5 provides the unique identifier of the in-scope NIST CSF Subcategory and the associated IoTSRM2 control with its adjusted weight. These IoTSRM2 controls are already prioritized within each IoTSRM2 objective given that there is only one control for each objective, and in effect the adjusted weight of each IoTSRM2 control is the same as the weight of the associated IoTSRM2 objective.