# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
###### Abstract
For example, CRS [8] pointed out that the deployment of 5G cellular networks and technologies will drive IoT growth. Juniper Research [11] adopted a similar tone on the IoT growth indicating 5G as a key driver for IoT adoption. With respect to the perks of leveraging 5G technology, the World Economic Forum [15] indicated 5G as a core component of IoT as it enables greater speeds and reliability of communications for much more IoT devices. According to McKinsey & Company's insights report, McKinsey & Company [17] highlighted that the revenues for 5G IoT modules and components will rise over time, which implicitly links the growth of IoT adoption to 5G deployment. It is worth noting that IoT denotes a system of interconnected homogeneous and/or heterogeneous systems and services that enable information processing and various interactions. This definition of IoT is derived from and based on the definitions from the CRS [8], IEC [10], and [PERSON] et al. [18]. In this sense, it is safe to say that IoT is fundamental towards achieving ubiquitous connectivity in this era of digital transformation [15; 19; 20]. Notwithstanding, for IoT, the current state of risk management is far behind the target state. Hence, the Ponemon Institute [5] underlined the burning need to place IoT risk management improvement high on the agenda. A.T. Kearney [6] placed poorer practices in risk management among the top ten business operations' challenges following their survey of around 450 senior executives of the world's leading organizations. As part of Deloitte's report on IoT, Deloitte [9] reported the finding of the Open Web Application Security Project (OWASP), which indicated the absence of integrated risk management approach for IoT data lifecycle management as a widespread challenge. World Economic Forum [16] pointed out immature IoT risk management capabilities, which may lead to poor IoT risk management practices. According to Bain [21], the majority of the 280 executives surveyed indicated a great level of concern around the IoT risks to which their organizations are exposed. In the context of managing IoT risk, cybersecurity related issues give rise to the greatest level of concern, and cybersecurity is regarded as pivotal for organizations. For instance, IEC [10] named security, trust, privacy, and identity management among the key limitations and deficiencies of today's IoT. As part of the World Economic Forum's report on the global state of IoT, World Economic Forum [16] highlighted privacy and trust, and safety and security as the top risk impact areas of IoT governance for organizations, which resulted from the 374 global IoT stakeholders surveyed. The great concern around cybersecurity is also reflected in the findings from the survey conducted by McKinsey & Company, where cybersecurity resulted in being the top priority for organizations when acquiring IoT products based on the responses from 1161 global IoT practitioners [22]. As part of the AT&T cybersecurity insights report, AT&T [7] claimed that IoT security is the top concern of the Chief Executive Officer's (CEO) agenda. According to findings from the study conducted by McKinsey & Company [13], 75% of the 400 IoT experts surveyed indicated IoT security as either important or very important. As per the findings of Bain [21], the more mature are the organizations in terms of their cybersecurity capabilities, the more importance they place on their IoT risks. Hence, IoT security risk management may raise the greatest level of concern among organizations as there is no general IoT security model [10], there is no global IoT security standard [16], there are only a few IoT security standards [13], and most best practices are not focused on IoT security risk management [12; 15]. Moreover, cybersecurity strategies tend to be developed reactively rather than proactively in the transformation journey [3; 16; 23]. In this context, it is very likely that, amid adopting IoT, many organizations out there lack adequate IoT security risk management strategies.