# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 3 Results
### Our Proposed IoTSRM2
**IoT supply chain risk management plan (SC.A.1):** An organization-wide IoT supply chain risk management plan, which is aligned with IoT security policy and part of broader cyber supply chain risk management program, is documented, formally approved, periodically reviewed, and up-to-date. The organization's IoT suppliers have and maintain cyber supply chain risk management plans to effectively address cyber supply chain risks across their whole IoT supply chains. The informative references for this IoTSRM2 control are [28]; [40]: 12; [46]: SDV-15; [47; 48]; [50]: 2.4.3.6; [55]: OP-26, TM-07; [56; 58; 60]. **IoT supply chain risk assessment (SC.A.2):** IoT suppliers across supply chain tiers are identified and tracked throughout the entire supplier relationship lifecycle, their criticality to the business is determined, and IoT supply chain risks are regularly assessed and recorded as part of the board-approved, periodically reviewed, and up-to-date cybersecurity risk register. The IoT supply chain risk assessment follows the IoT supply chain risk management plan. The organization's IoT suppliers continuously or regularly assess cybersecurity and privacy supply chain risks through a combination of supplier assessments (e.g., penetration tests, site visits), document findings incorporating IoT supply chain risk exposures, and disclose cybersecurity-related supply chain risk assessment findings to IoT adopters. The informative references for this IoTSRM2 control are [40]: 11; [43; 44; 45]; [46]: RSM-02; [48]; [53]: 4.2.3; [54]; [55]: PS-19, TM-10; [56; 59; 60]. _Supplier contract management (SC.B)_  
The \"Supplier contract management\" objective has two IoTSRM2 controls. **IoT supplier contract management plan (SC.B.1):** An organization-wide IoT supplier contract management plan, which is aligned with and part of a wider contract management plan, is documented, formally approved, periodically reviewed, and up-to-date. This plan is in line with the organization's IoT security and privacy controls framework, cybersecurity regulatory framework, and IoT security policy, and it is part of the broader cyber supply chain risk management program. The organization's IoT suppliers have and maintain robust supplier contract management plans for ensuring trusted supplier relationships throughout the entire contract lifecycle and disclose relevant supply chain changes to IoT adopters. The informative references for this IoTSRM2 control are [28]; [40]: 1, 21, 29; [41; 44]; [46]: OPA-05, RMT-01; [48]; [50]: 2.4.5.36; [51]: Principle 5: Key concept 20; [53]: 4.2.1, 4.2.3, 4.2.4; [55]: OP-05, OP-27, TM-30; [56]; [57]: GP 23; [58]. **IoT trustworthiness requirements (SC.B.2):** Cybersecurity, privacy, safety, reliability, and resiliency requirements for the organization's IoT supplier contracts are established, documented, formally approved, periodically reviewed, and up-to-date. These requirements are defined based on applicable IoT regulations, IoT security best practices, and the organization's IoT security policy as part of the IoT supplier contract management plan. The organization's IoT suppliers provide up-to-date cybersecurity bills of materials (CBOMs) to IoT adopters for the IoT products they acquire, hold original equipment manufacturers (OEMs) accountable to ensure trust down the supply chain, and have IoT supplier contracts that incorporate cybersecurity, privacy, safety, reliability, and resiliency requirements which provide appropriate levels of detail, clarity, trustworthiness, and service targets, to enable IoT supply chain of trust. The informative references for this IoTSRM2 control are [28; 30]; [40]: 3, 4, 12, 22, 24, 26, 28, 31, 36, 44; [46]: CLS-04, GVN-02, RMT-02; [48]; [51]: Principle 2: Key concept 3; [54]; [55]: PS-06, OP-01, OP-02, OP-03, OP-26, TM-08, TM-09; [57]: GP 30; [58; 59]. Then, for each IoTSRM2 objective of the \"Supply Chain Risk Management\" domain, Table 9 provides the unique identifier of the in-scope NIST CSF Subcategory and the associated IoTSRM2 controls with their adjusted weights.