# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 2 Materials and Methods
### Methodology for Developing the IoTSRM2
In addition, Step 1.1 provides the limitations of the proposed methodology. These are enumerated below:  
* The proposed methodology is derived, based on, and limited to our professional judgement and selected best practices;
* The proposed methodology is limited to the assumptions on which it is based. **Step 1.2 Extract NIST CSF Categories and Subcategories relevant to NIST SP 800-37 Task P-2**  
Step 1.2 funnels the NIST CSF Core to focus the proposed reference model on those Categories and Subcategories that are more relevant to Risk Management Strategy. Hence, this step narrows the focus on the NIST CSF Identify Function considering that Task P-2 (Risk Management Strategy) of NIST SP 800-37 aligns with NIST CSF Identify Function [72]. **Step 1.3 Extract NIST CSF Identify Categories and Subcategories relevant to NIST-TIR 8228 rec. 5.1**  
Step 1.3 further funnels the NIST CSF Identify Function to focus the proposed reference model on those Categories and Subcategories that are more relevant to IoT security. This step further narrows the focus and identifies those Categories and Subcategories of the NIST CSF Identify Function that are more prone to adjustments when it comes to addressing IoT security risk [73]. Hence, it allows the determination of the domains for the IoTSRM2 and the in-scope NIST CSF Subcategories for the IoTSRM2 objectives. Furthermore, the IoTSRM2 domains are represented using Equation (1), where \(x_{i}\) represents the six domains of IoTSRM2, and C represents the cardinality of \(x_{i}\):  
\[x_{i}=\left\{ \begin{array}{c}\text{Asset Management, Business Environment, Governance,}\\ \text{Risk Assessment, Risk Management Strategy,}\\ \text{Supply Chain Risk Management}\end{array} \right\},\text{ where C}=|x_{i}|=6,\text{ i}=[1\ldots\text{C}] \tag{1}\]  
**PHASE 2 ANALYSIS**  
Then, the analysis phase involves the selection and mapping of IoT security requirements from the in-scope IoT security best practices (Step 2.1), the categorization of IoT security requirements (Step 2.2), and the definition of IoTSRM2 objectives (Step 2.3). **Step 2.1 Select and map IoT security requirements**  
This step involves the identification of the in-scope IoT security requirements from 25 selected IoT security best practices (see Section 2.1). First, IoT security requirements are selected by applying on the selected IoT security best practices the selection criteria outlined below:  
* **High-level objectives for IoT adopters:** the IoT security requirement is relevant for the development of organizational understanding to manage cybersecurity risks and makes reference to high-level IoT security risk management objectives for IoT adopters;
* **High-level objectives for IoT adopters and high-level postmarket objectives for IoT suppliers:** the IoT security requirement is relevant for the development of organizational understanding to manage cybersecurity risks and makes double reference to both high-level IoT security risk management objectives for IoT adopters and high-level IoT security risk management objectives for IoT suppliers related to the operations/maintenance and/or disposal of IoT devices and/or services for IoT adopters;
* **High-level postmarket objectives for IoT suppliers:** the IoT security requirement is relevant for the development of organizational understanding to manage cybersecurity risks and makes reference to high-level IoT security risk management objectives for IoT suppliers related to the operations/maintenance and/or disposal of IoT devices and/or services for IoT adopters. Then, the resulting IoT security requirements are analyzed relative to the in-scope NIST CSF Subcategories from Step 1.3 to determine the in-scope IoT security requirements. Hence, the IoT security requirements are mapped against the in-scope NIST CSF Subcategories from Step 1.3. **Step 2.2 Categorize in-scope IoT security requirements**  
Step 2.2 involves the grouping of related in-scope IoT security requirements from Step 2.1 under the in-scope NIST CSF Subcategories from Step 1.3.