# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
###### Abstract  
Nowadays, Internet of Things (IoT) adoptions are burgeoning and deemed the lynchpin towards achieving ubiquitous connectivity. In this context, defining and leveraging robust IoT security risk management strategies are paramount for secure IoT adoptions. Thus, this study aims to support IoT adopters from any sector to formulate or reframe their IoT security risk management strategies to achieve robust strategies that effectively address IoT security issues. In a nutshell, this article relies on a mixed methods research methodology and proposes a reference model for IoT security risk management strategy. The proposed IoT security risk management strategy reference model (IoTSRM2) relies on the 25 selected IoT security best practices which are outlined using a proposed taxonomic hierarchy, and on the proposed three-phased methodology that consists of nine steps and outputs. The main contribution of this work is the proposed IoTSRM2 which consists of six domains, 16 objectives, and 30 prioritized controls. Furthermore, prior to providing the related work, this article provides a critical evaluation of selected informative references of IoTSRM2 based on their percentage-wise linkage to the IoTSRM2 domains and to the entire IoTSRM2. The findings of the critical evaluation illustrate, inter alia, the selected informative references that are the top three most and least linked to the entire IoTSRM2. Internet of Things; IoT security; cybersecurity; risk management; strategy; reference model; standards; guidelines; frameworks; best practices +
Footnote †: journal:  
0000-0001-4800-0000-0001-48000-00001-48000-00001-4800001-4800001-4800001-4800001-4800001-480001-480001-480001-480001-480001-480001-480001-480001-48000  
management and their survey report revealed, among others, that the number of connected IoT devices is expected to double within the next two years. As part of the AT&T cyber-security insights report, AT&T [7] pointed out the rapid growth of connected IoT devices worldwide which resulted from the 500 individuals surveyed on the state of IoT security. As part of the Congressional Research Service (CRS) report on IoT, CRS [8] reported the forecast of the market research firm IoT Analytics which predicted that the number of global active IoT devices will substantially rise from 9.9 billion in 2019 to 21.5 billion in 2025 and that the global IoT market growth is expected to reach USD 1.56 billion by 2025. According to Deloitte's report on IoT, the global IoT spending is projected to grow from USD 726 billion in 2019 to USD 1.1 trillion by 2023 [9]. As highlighted by the International Electrotechnical Commission (IEC) [10], IoT has a significant impact on the global economy based on the IoT market forecasts of three worldwide well-renowned consulting firms. As part of the Juniper Research's whitepaper on IoT, Juniper Research [11] provided a more aggressive projection for the total global number of IoT connections which could get to 83 billion by 2024. According to [PERSON] [12], an increasing number of IoT devices are connected. This increasing tendency of organizations to connect more and more devices, products, and systems is also articulated as part of the McKinsey & Company's insights report, where McKinsey & Company [13] indicated this tendency as a key driver towards the massive rise of IoT. McKinsey & Company [14] also anticipated a steady growth of IoT investments and the increase of the worldwide number of IoT connected devices to 43 billion by 2023. The prospects of IoT growth were echoed by World Economic Forum [15] which predicted 25 billion connected IoT devices globally by 2025. As part of another insight report, World Economic Forum [16] increased their expectation from 25 billion connected devices worldwide to 41.6 billion and highlighted the investment growth surrounding IoT adoption. Furthermore, IoT adoption will soar with the deployment of the 5G technology as it enables much more connected devices to benefit from far better mobile communications.