# A Survey on Cyber Risk Management for the Internet of Things
## 6 Recommendations
### Recommendations for IoT Cyber Risk Control  
Risk assessment results facilitate the selection of appropriate risk responses to control risk. IoT risk response should not only consider the most suitable risk mitigation methods but also determine risk responses, such as transference, where possible. Future works need to consider how effectively security decision making can be performed to ensure that risk control is effective. Given the lack of in-depth IoT cyber risk control within the surveyed papers, there is also a need to pay attention to how IoT controls are chosen. Below, we suggest questions for future works and recommend ways to overcome problems within IoT cyber risk control processes. _What are the available IoT security controls and how effective are they?_ Risk assessment results facilitate the selection of appropriate risk responses that reduce risk to acceptable levels. To be appropriate, identified controls need to be viable for an IoT domain, meaning they effectively reduce risk, meet security requirements, and examine the resources needed to do so. IoT security capabilities are often extremely limited, relying on user interaction and configurations to ensure security. Existing IoT controls should already be known; however, the risk results will reveal how effective they are and if more controls are required. Much like identifying threats, various papers and guides have documented controls for various IoT domains. For organisations, the CIS controls IoT companion guide [96] can be used to apply CIS controls in the context of IoT. Meanwhile, The European Union Agency for Cybersecurity (ENISA) published a good practice guide for smart grids [108] as well as a cyber security and resilience guide for smart hospitals [109]. In turn, ENISA also produced a good practice web tool for smart infrastructures [110], which includes advice on smart cities, aviation, etc. Lastly, for smart homes, NIST published an article that underlines key mitigation methods that aid in ensuring smart home security [111]. For future works, identifying specific controls from the IoT literature will aid in understanding the available controls for an IoT domain, while also considering the upkeep of IoT cyber hygiene. The IoT literature may also aid in the estimation of control effectiveness and the rate at which effectiveness degrades to ensure the best controls are utilised. _What are the security requirements for an IoT domain and how can controls ensure security requirements are met?_ For organisations, security objectives are defined in line with regulations and law; however, in non-organisational IoT domains (like smart homes), requirements may not have been formed. We find that researchers often do not describe specific security objectives that need to be met for risk to be acceptable. This missing aspect challenges future works to uncover what the security requirements are for an IoT domain and the controls that are needed to meet security goals. To combat this, IoT security requirements need to be clearly defined first, an extra challenge for unregulated IoT domains like smart homes. Defined IoT security requirements are the goals to be achieved by an IoT control to satisfy a strong level of security and apply to all domains since establishing security goals can help to define unacceptable risk levels. _What are the IoT security resources that affect the selection of IoT controls?_ Another limited topic is the consideration of resources required to ensure effectiveness and usability. Resources can refer to more than money, like the time and effort needed to use IoT controls. Assessing control accessibility is integral to determine risk acceptance thresholds, as not all risks may be controlled due to a lack of resources for IoT controls. For IoT domains such as organisations, healthcare, smart cities and smart grids, the cost and time of a control's implementation and maintenance may outweigh the mitigation benefits.