# A Survey on Cyber Risk Management for the Internet of Things
## 3 Materials and Methods
#### Research Questions  
Overall, we gathered 39 papers in the domain of IoT cyber risk management. To discuss the fundamentals of IoT cyber risk frameworks, we answered four research questions based on a well-known cyber risk management model from ISO 31000:2009 [28], splitting our work into two high-level processes, IoT cyber risk assessment and IoT cyber risk treatment. - **RQ1: How does the current literature undertake IoT cyber risk identification? ** IoT cyber risk identification involves processes that uncover various risk parameters needed to assess risk, with cyber risk identification needing to be clearly defined so that the data collected are useful. The most fundamental risk parameters categories defined within NIST and ISO frameworks are assets, users, threats, vulnerabilities, security controls, impact, and likelihood. For IoT, before threats and vulnerabilities can be determined, the elements of an IoT system (assets, users, and existing controls) need to be identified first, ref. [29]. Traditional IT threats and vulnerabilities are well documented within many repositories, for example the National Vulnerability Database (NVD) [30] and Common Vulnerabilities and Exposures (CVE) [31]. However, IoT has the caveat of heterogeneous components (for example, sensors), which suggests that an IoT cyber risk management framework must extend existing threats and vulnerabilities to factor in IoT elements. Due to well-established risk management concepts, impact and likelihood are required to assess risk. This is because impact reflects the result of an attack, which leads to a degree of harmful consequences and, in all likelihood, reflects the probability of an attack [22]. IoT cyber risk management frameworks must ensure that assessed risk values are meaningful and well defined with a clear rationale. For each of the risk parameters uncovered in the IoT cyber risk identification phase, we want to know how IoT frameworks handle this process. Figure 2: The proposed PRISMA flow model for article selection and results. - RQ2: How does the current literature calculate IoT cyber risk? ** Once risk identification processes are completed, risk needs to be analysed and evaluated. IoT cyber risk calculation requires various methods to analyse and evaluate risk producing results in qualitative, quantitative, or semi-quantitative ways [32]. There are many approaches that could be used to assess and quantify risk, with IoT cyber risk management frameworks using methods like the use of risk matrices, graph modelling, and the use of vulnerability databases to uncover risk values. Without a risk assessment that calculates meaningful risk results, providing in-depth knowledge about IoT security would be difficult. This means that comparing the results to determine if risks are acceptable (risk evaluation) [7] is much harder with critical risks potentially being missed. Given what we discussed, we use this research question to uncover the methods used to perform the IoT risk calculation to determine meaningful results. - RQ3: How does the current literature control IoT cyber risk? ** Cyber risk treatment involves processes that deal with how to handle risk responses involving the action of \"accepting, avoiding, mitigating, sharing, or transferring risk to organisational operations\" [15]. Acclimating an effective and efficient risk response is essential to IoT systems to ensure that assets and users are protected from harm. To achieve this, risk decision making (the process of making decisions resulting in positive or negative consequences [33]) is needed to ensure that all IoT constraints and risk assessment results are factored into the risk response. Controlling IoT risk will likely differ from traditional IT due to novel innovations and functionalities within environments that we have not seen before. Therefore, making IoT risk decisions requires security goals to be clearly defined, with these goals considering the new functionalities to assure conformity.