# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 3 Results
### Our Proposed IoTSRM2
Hence, for \"Security related policies\", \"Structures and responsibilities\", \"Regulatory requirements\", and \"Governance and risk management plans\", the most important IoTSRM2 controls based on adjusted weights are \"IoT security policy\", \"IoT security governance structures and responsibilities\", \"Cybersecurity regulatory framework\", and \"IoT security and privacy controls management plan\", respectively. **Risk Assessment (RA)**  
The \"Risk Assessment\" domain of IoTSRM2 consists of the following four objectives:  
* Vulnerability discovery (RA.A): Determine whether IoT vulnerabilities are identified and documented;
* Threat identification (RA.B): Determine whether IoT threats are identified and documented;
* Risk analysis (RA.C): Determine whether IoT risks are identified and analyzed;
* Risk responses (RA.D): Determine whether IoT risk responses are identified and prioritized. _Vulnerability discovery (RA.A)_  
The \"Vulnerability discovery\" objective has two IoTSRM2 controls. **Disclosure-based IoT vulnerability discovery (RA.A.1):** Cybersecurity and privacy vulnerabilities across the organization's IoT assets are continuously identified and documented from multiple external sources. The activities of identifying IoT vulnerabilities from external sources are coordinated as part of the organization's cybersecurity risk assessment process. The organization's IoT suppliers use information sharing platformsfor finding vulnerability information and leverage their vulnerability disclosure policy and mechanisms to incentivize third-party vulnerability reporting and to release timely security advisories for the identified vulnerabilities in the IoT products and/or services they provide. The informative references for this IoTSRM2 control are [28; 30]; [40]; 9; [41; 42]; SDV-05; [47; 49]; [50]; 2.4.3.7, 2.4.3.9; [51]: Principle 5: Key concept 18; [54; 59; 60; 61]. **Assessment-based IoT vulnerability discovery (RA.A.2):** The attack surface of the organization's IoT footprint across its entire system lifecycle is continuously or periodically identified and documented using a blend of various well-structured assessment processes which leverage effective cybersecurity methodologies and solutions. The activities of identifying IoT vulnerabilities and control weaknesses are coordinated as part of the organization's cybersecurity risk assessment process. The organization's IoT suppliers perform and document continuous or periodic assessments of their cybersecurity postures and of the vulnerabilities relating to the IoT products and/or services they provide, in order to achieve ongoing vulnerability monitoring and cybersecurity improvement. The informative references for this IoTSRM2 control are [28; 30]; [40]; 8; 10; 12; 44; [46]; GVN-03, PRV-02, PRV-04, RSM-02, SOP-02, TMM-01, TMM-02, TMM-04, VLN-01; [47; 48]; [50]: 2.4.10.9, 2.4.13.5; [51]: Principle 2: Key concept 4, Principle 2: Key concept 5, Principle 2: Key concept 6, Principle 5: Key concept 21; [52; 54]; [55]: PS-09, PS-19, PS-21, OP-04, OP-17, TM-10, TM-14, TM-15; [56]; [57]: GP 2, GP 8, GP 11, GP 19, GP 30; [58; 59; 60]. _Threat identification (RA.B)_  
The \"Threat identification\" objective has two IoTSRM2 controls. **Intelligence-driven IoT threat identification (RA.B.1):** IoT threats are continuously identified, centralized, and documented from multiple external threat sharing sources. The activities of identifying IoT threats from external sources are coordinated as part of the organization's cybersecurity risk assessment process and in line with cyber threat intelligence program. The organization's IoT suppliers continuously engage in cyber threat information sharing, employ cyber threat intelligence for acquiring insights into the latest cyber threats and data breaches, and leverage an effective vulnerability disclosure program for identifying cyber threats to the IoT products and/or services they provide and releasing security advisories.