IoT-specific factors and inputs must be considered when identifying risk sources; the risk management itself should use standardised approaches: ISO 31000 for generic risk management, ISO/IEC 27005 for information security risk, IEC 62443 for industrial automation and control, ISO/IEC 29134 for privacy impact assessment, and where an ISMS is required ISO/IEC 27001 and, for privacy information management, ISO/IEC 27701. The IoT-specific risk sources are detailed in 6.2.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.