# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 2 Materials and Methods
### Overview of IoT Security Best Practices
#### 2.1.4 Supplier Specific IoT Security Best Practices  
This subsubsection provides an overview of the selected supplier specific IoT security best practices. Each of these best practices is outlined below under its corresponding type-based category (i.e., codes of practice, guidelines, frameworks). **Supplier Specific IoT Security Codes of Practice**  
The selected supplier specific IoT security codes of practice provide a set of IoT security measures recommended by the UK Government [61] and Australian Government [42]. These codes of practice are outlined below:  
* **UK DCMS's Code of Practice for Consumer IoT Security:** This code of practice [61] provides 13 prioritized guidelines for improving the security of consumer IoT products and associated services, and applies to device manufacturers, IoT service providers, and mobile application developers and retailers [18]. In addition, for each IoT security guideline, the document lists the target stakeholders. In addition, this document (i.e., [61]) is supplemented by a comprehensive mapping document (i.e., [27]) which maps each recommended guideline against related IoT security recommendations, guidance, and standards [68];
* **Australian Government's Code of Practice Securing the Internet of Things for Consumers:** This document aligns with and builds upon the UK DCMS's Code of Practice [61]. It provides a voluntary set of 13 principles as the minimum standard for improving the security of IoT devices and services in Australia and highlights the top three IoT security principles (i.e., no duplicated default or weak passwords, implement a vulnerability disclosure policy, keep software securely updated). In addition, for each recommended IoT security principle, the document lists the target stakeholders which range from device manufacturers to retailers [42]. **Supplier Specific IoT Security Guidelines**  
The selected supplier specific IoT security guidelines are outlined below:  
* **AIOTI's Report on Workshop on Security and Privacy in the Hyper-Connected World:** This report provides basic security and privacy requirements on four key areas, including practical privacy in IoT device, IoT hardware and components, interfaces, communication, cloud, and applications [41];
* **U.S. NHTSA's Cybersecurity Best Practices for Modern Vehicles:** This document [60] provides cybersecurity guidance for automotive industry and applies to motor vehicle and motor vehicle equipment designers, suppliers, manufacturers, alterers, and modifiers [18]. **Supplier Specific IoT Security Frameworks**  
The selected supplier specific IoT security frameworks are outlined below:  
* **GSMA's IoT Security Assessment Checklist Version 3.0:** This self-assessment checklist document [47] provides a set of general and specific security recommendations for IoT service and endpoint ecosystems, and it applies to IoT service providers, IoT service platform vendors, and IoT device vendors [18]. The general recommendations include IoT security and privacy recommendations at the organizational level (i.e., risks assessments, privacy considerations, secure development), and IoT security recommendations for service platforms and endpoint devices. The specific IoT security recommendations target service platforms and endpoint devices, and are categorized into critical, high, medium, and low priority recommendations. In addition, this self-assessment document allows organizations willing to assess their compliance against its recommendations to rate each of the controls associated with each of the questions of each recommendation [47].