{'fraction_non_alphanumeric': 0.023698733903257222, 'fraction_numerical': 0.010063845904122931, 'mean_word_length': 5.347184065934066, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Definition of Internet of Things (IoT) Cyber Risk Discussion on a Transformation Roadmap for Standardisation of Regulations Risk Maturity Strategy Design and Impact Assessment

A comparative empirical analysis is performed to define a high-level potential target state followed by a high-level transformation roadmap, describing how company can achieve their target state, based on their current state. The transformation roadmap is used to adapt the Goal-Oriented Approach and the IoT Micro Mart model.


Introduction
Economic impact of Internet-of-Things (IoT) cyber risk is increasing with the integration of digital infrastructure in the digital economy 1 . Cyber security standardisation and regulation would play a key role in the process of reducing cyber-attacks while continuing to harness the economic values.
The cyber risk from IoT devices is present across different and sometimes at a higher level in sectors where such risk is unexpected. For example, in the US, healthcare is now the largest target of cyber security attacks, reportedly at greater risk than manufacturing and banking 2 . According to the same report 2 , the value of stolen personal health information is ten to twenty times greater than the value of a stolen credit card number. To understand and define a generic target state for cyber maturity, we need to understand the business context and the cyber risk priorities through discussions between cyber security experts and decision makers 3 .
This research article conducts epistemological analysis focused on understanding the best approach for increasing safety, security and economic value in the IoT space. Our research has two objectives. To identify and capture a high-level target state for the mitigation of cyber risk from the IoT, and to adapt existing cyber security practices and standards to include IoT cyber risk in a highlevel cyber security transformation roadmap. We discuss and expand on these further in the remainder of this article. In Section 2 we present the research methodology.

Methodology
There is a strong interest in regulating the cyber risk assessment procedures. Regulation and standardisation of cyber security frameworks, models and methodologies has not been done until present. Standardisation in this article refers to the compounding of knowledge to advance the efforts on integrating cyber risk standards and governance, and to offer a better understanding of cyber risk assessments. Here we combine literature analysis with an empirical with a comparative analysis. The empirical analysis is conducted with seven cyber risk frameworks and two cyber risk models. The comparative analysis engages with fifteen high-tech national strategies.

Current state of cyber risk
Current cyber risk trends are based on risk from intelligent manufacturing equipment, artificial intelligence, the cloud, and IoT, creating risk from systems of machines capable of interacting with the cyber-physical world 4,5 . The integration of new technologies creates cyber security risk, e.g. integrating less secured systems 6 in manufacturing 7 and supply chains [8][9][10][11][12] . Existing cyber risk assessment models [13][14][15][16][17][18][19] ignore the risk impacts of sharing infrastructure and the cyber risk estimated loss range variously 1 . Further cyber risk assessment challenges emerge from compiling of connected systems devices and platforms 4,20 . The machines are becoming social CPS 21-23 operating as real-time IoT systems of systems 24,25 , creating cyber risk from data in transit. This requires standardisation of design and process 15,26 because such system security is complex.

4
Uncovering the best method to define a unified cyber risk assessment through a comparative empirical research study

Comparative study of IoT in Industry 4.0
From this comparative study, the main IoT risk elements of each IoT strategy are compounded into categories representing the most prominent IoT cyber risk vectors (see Table 1). However, the compelling of data into these categories is quite challenging, as some strategies, represent a collection of descriptive explanations and do not provide explicit IoT cyber risk vectors. Such descriptive explanations present complexities in developing a unifying strategy. To resolve this issue, we use the grounded theory methodology, where most prominent IoT cyber risk vectors are categorised and used as reference themes. Then, the categories are used for examining IoT cyber risk, to define a standardisation approach that relates various IoT risk vectors to eliminate conflicts in different and sometimes contrasting assessments of risk vectors.

Empirical analysis of gaps in cyber risk impact assessment approaches
The empirical analysis aims to identify cyber security frameworks and to compare interlinkages with the IoT risk in the Industry 4.0. Some of the frameworks reviewed propose diverse qualitative methods, and some qualitative approaches for measuring cyber risk propose methodologies [27][28][29][30][31] .
The most advanced cyber risk impact assessment framework is the US NIST 32 . The NIST framework argues that to reach the required cyber security maturity level, the current cyber state can be transformed into a given a target cyber state by applying a specific cyber security framework implementation guidance 33 . However, the NIST guidance is specifically designed for Federal Agencies and requires adaptations to be applicable to enterprises. The NIST framework requires determining a detailed current cyber profile and a maturity level but does not provide a model for these steps.
The CVSS calculator 34,35 could be used to create a current cyber profile, in addition to the Exostar system 36 for determining the supply chain cyber maturity level, and CMMI 37 the overall current state of cyber maturity. The final gap in the NIST framework is the lack of cyber risk quantitative assessment, which is crucial for making an informed and detailed recommendations for a target cyber profile. The Factor Analysis of Information Risk Institute (FAIR) 38 aims to address this gap in the NIST framework. FAIR Institute adapts existing quantitative models, e.g. RiskLens 39 , and Cyber VaR (CyVaR) 40 . In a way, FAIR is complementing the work of NIST and the International Organisation for Standardisation (ISO) 41 , which is the international standard-setting body and includes cyber risk standards. Notable for this discussion, only FAIR 38 provides recommendations for quantitative risk estimation. To complete the risk assessment, the cyber risk from supply chains needs to be simplified 31,42,43 . To identify a current cyber risk state that includes supply chain cyber risks, the Exostar system 36 , can be used for complimenting the CVSS and covering the supply chain aspect of cyber risk. Further analysis, including SWAT and GAP analysis are considered beyond the scope of this conference paper, but can be found in other articles [43][44][45][46][47] .

Transformation roadmap for standardisation of IoT risk impact assessment
To define a transformation roadmap for standardisation of IoT risk impact assessment, the methodology follows recently established approaches 1,4,5,44,47-49 . The design principles define how to identify, manage, estimate, and prioritise cyber risk (Table 1) In Table 1, the resulting definition of transformation roadmap are reduced in content with the controlled convergence methods 31 .

5
Case study research

The case study
The case study research involved four workshops that included 18 distinguished engineers from Cisco Systems, and 2 distinguished engineers from Fujitsu. The workshops with Cisco Systems were conducted in the USA in four different Cisco research centres. These centres were as follows: First Centre -Security and Trust Organisation; Second Centre -Advanced Services; Third Centre -Security Business Group; and Fourth Centre -Cisco Research Centre. In pursuit of validity, a separate workshop was conducted with two experts from Fujitsu centre for Artificial Intelligence the UK. The Fujitsu workshop was conducted separately to avoid those experts being influenced or outspoken by the larger group from Cisco systems.
The first two Cisco workshops were conducted to apply the controlled convergence 9,31 . This approach to pursuing validity follows existing literature on this topics 50,51 and provides clear definitions that specify the units of analysis for IoT cyber risk vectors. The IoT risk units of analysis from individual IoT strategy are combined into standardisation vectors. The process of defining the standardisation vectors followed the controlled convergence method 8,52 , where experts were asked to confirm the valid concept, merge duplicated concepts, and delete conflicting concepts. The main limitation of the Pugh controlled convergence method is the difficulty in gathering large number of experts in one location.

Transformation imperatives describing how IoT companies can achieve their target state based on their current state with a Goal-Oriented approach
Following the identification of a high-level target state in the comparative empirical analysis, the controlled convergence was applied to narrow the emerging implementation tasks through case study. The controlled convergence was applied for the development of a transformation roadmap for the high-level target state (Table 1). To build the transformation roadmap, the emerging categories are validated with applying the controlled convergence with a group of experts. The process of confirming validity of the data in Table 2, outlines the transformation process but does not include all the steps as the aim is to present a methodology, not the actions. The rationale is that different enterprises will have different cyber security steps to perform in order to transition to a higher maturity lever. A long and detailed list of steps can be found in some of our work in progress articles 42,43,46 .
High level transformation imperatives Training and awareness Control goal (parent) 1: Security skills assessment and training Control objective (child) 1: Skills and integrated plan to support defence of the enterprise. Control element (orphan) 1: Analysis of needed skills; provide training to match the required skills and validate skills through periodic tests. More advanced control orphans include: security assessments using real-world examples to measure mastery or skills. Control goal (parent) 2: Penetration testing. Control objective (child) 2: Test the defences by simulating cyber-attacks. Control element (orphan) 2: Regular focussed penetration tests for detecting unprotected systems through vulnerability scanning and penetration testing combined. Control goal (parent) 3: Mobile device Control objective (child) 3: Mitigate cyber risk from mobile devices. Control element (orphan) 3: Mobile devices should have access controls to enforce policies and option to remotely clean the device. Cyber threat intelligence Control goal (parent) 1: Boundary defence Control objective (child) 1: Manage the flow of information between network trust levels. Control element (orphan) 1: Prevent communications with malicious IP addresses, use two-factor identification; design DMZ network and scan connections that aim to bypass the DMZ; block known bad signature or attack behaviour. Security event monitoring Notes: links with: (a) network security; (b) identity and access management. Control goal (parent) 1: Maintenance, monitoring and analysis of audit logs Control objective (child) 1: Collect, manage and analyse audit logs of events. Control element (orphan) 1: Two synchronised timestamps in logs to ensure consistency; develop a log retention policy. Control goal (parent) 2: Secure configurations for network devices such as firewalls, routers and switches Control objective (child) 2: Actively manage the security configuration of the network infrastructure. Control element (orphan) 2: Documenting all new configurations rules that allow traffic to flow through network security devices; use two-factor identification and encryption. Control goal (parent) 3: Account monitoring and control Control objective (child) 3: Control the life-cycle of system and application accounts. Control element (orphan) 3: Disable unused account; imprint accounts expiration date; enable revoking system access accounts; log-off users after a standard period of inactivity; encrypt transmitted passwords. For implementing the recommendations emerging from the transformational imperatives, we refer to the NIST cyber security implementation tiers as support guidance. These implementation steps are the prime focus of government and industry efforts for improving cyber security exposure. In the following section, the transformation roadmap and imperatives can be used to define a new IoT risk impact assessment with a goal-oriented approach and the Internet of Things Micro Mart model.

6
IoT risk impact assessment with the transformation roadmap and imperatives Dependency goal-oriented modelling can be applied to connect unconnected risk models and to build a risk model for a complex IoT systems. The first step is to link separate models. This requires identifying the shared principles from the multiple models that we are connecting. Then, to determine the level of dependency risk, we need to understand the dependencies of the shared principles.

IoT Risk Analysis through Functional Dependency
Dependency modelling and analysis provides a means to support the management of functional and operational complexities within IoT systems with focus on the system elements, measures of a design or operational challenge, as well as the functional dependencies that define their associations. Dependency modelling and analysis can support a superior understanding of connectivity and its implications on performance, and can assist in constructing, improving, and maintaining of such complex system. The construct and exchanges that happen in IoT domain defines a tightly coupled association amongst constituting components and sub-systems such considerably on the correct functions of another linked component or system. This is considered a dependency relationship, and can either be direct (a first order dependency) or indirect (a subsequent higher order dependency) 53 . For example, from a typical IoT architecture 54 , normal functions for components and services on the application layer typically depend on the normal functioning of their counterparts on the network layer. This latter also relies on the perception layer component and services. If a component or service on the perception layer is compromised, such impairment can alter the correct functioning of connected component or service on the network or application layers. Thus, security risks in an IoT domain may not exactly be drawn from the failure of one specific IoT component, but most often extend to the failure of other IoT components that can be recipients of rippling impacts. This dependency amongst IoT sub-systems and components can also cause impacts or failures to cascade from one affected system or component onto another; worsening the damaging impacts 55,56 . One way of achieving IoT dependency modelling is through a network-based functionality dimensionanalysing how the functionality of one system or component can affect the functionalities of other systems or components 57 , explorable on the basis of connectivity and process configurations over multi-layered IoT architecture. Graph theory 53,58 -using vertices and edges; provides a way to simply represent (directly or logically) the dependency of IoT components within and across multiple functionality layers.

IoT risk impact assessment with a Goal-Oriented Approach
Identifying shared principles for multiple independent cyber risk models is challenging, because risk assessment is not based on shared risk estimation. This can partially be resolved by focusing on the success factors and concentrating on the external dependencies. In this approach, individual risk vertices are considered as representative of a larger complex IoT system. This advocates a top-down, or goal-oriented modelling approach 31,46 , where success factors are traversing across multiple isolated models. The paradigm can provide a real-time statistical assessment of cyber risk of all the entities in the model. The dependencies between a dynastic metaphor, such as 'parent', 'child', 'orphan' are explained in the transformational roadmap, can be analysed with computational statistics using a Bayesian analysis engine 59,60 .

Micro Mort
Since there is no International IoT Asset Classification (IIoTAC) and no established Key IoT Cyber Risk Factors (KIoTCRF), for the calculations of the new model, we would firstly need to determine the IIoTAC and the KIoTCRF 1,5 . After the establishment of IIoTAC and KIoTCRF, the new model could be applied to calculate more precise 'willingness to pay' to reduce IoT cyber risk.

Conclusion
This article combines existing literature and performs comparative, empirical and theoretical analysis of common cyber risk assessment approaches and integrates current standards. The findings present a map of the present initiatives, frameworks, methods and models for assessing the impact of cyber risk. Hence, the article advances the efforts of integrating cyber risk standards and governance and offers a better understanding of a holistic impact assessment approach for IoT cyber risk. This enables visualising the interactions among different sets of cyber security assessment criteria and results with a new design criterion specific for cyber risk from the IoT. The visualisation of cyber risk can be used by practitioners and regulators to inform organisations in this space of best practices. The design principles, with the transformational roadmap, can be applied to assess the impact of cyber compromises and to make cyber security recommendations. The findings are relevant to national and international Industry 4.0 networks, specifically for IoT cyber risk planning.

Limitations and further research
Holistic analysis of all risk assessment approaches was considered beyond the scope of this study. Additional research is required to integrate the knowledge from other studies. The epistemological framework in this article presents a generic approach to guide researchers and practitioners. Author