4 Accountability & Risk Impact Assessment by Design – Any data controller and processor to be accountable for regulatory, contractual and ethical compliance. If data is compromised, disclosed, accessed or lost, clear statement by vendors, data controllers and data processors on impact is another prerequisite. 5 Awareness & Information Supplied with Indication of Purpose – Technically regulating access to data to define who can use it for what purpose, and how that can be made transparent, and subsequently measured and monitored. Design in a transparent way, so the data subject is and remains clear and aware of privacy issues, choices it makes and possible consequences thereof. 5.1.2 Key Findings – There is no single set of IoT security and privacy principles that is internationally recognised and adopted. – The diversity in proposed IoT security principles between different countries and initiatives illustrates a lack of collaboration, especially between governments. – Due to the lack of globally-adopted principles, a language towards common understanding of shared IoT challenges and issues is lacking. Such a language is required to define a global governance process. – Consumers and companies are not uniformly aware of the cybersecurity risks and may not be equipped to respond properly. 5.2 IOT SECURITY STANDARDS AND GUIDELINES While numerous standards exist in the IoT space, IoT security has not been standardised significantly until now; a recent ETSI standard is one of the first efforts to standardise IoT security.108 While numerous sets of IoT security recommendations exist, it is important to harmonise and align these for global acceptance and adoption as a precursor to developing evaluation and certification schemes. 108 https://www.etsi.org/newsroom/ press-releases/1549-2019-02-etsi-releases-first-globally-applicablestandard-for-consumer-iot-security 109 https://www.itu.int 110 https://www.nist.gov/ 5.2.1 Current Landscape and Recent Developments Standards development organisations (SDOs) such as ITU109, NIST110, ETSI111, IETF112, and ISO113 have all undertaken IoT-specific efforts. Gartner’s Hype Cycle for IoT Standards and Protocols114 profiles as many as 30 IoT standards, 15 of which have been marked to deliver “high business benefit.” Six of those are expected to become mainstream in the next five years, including the below networking standards. – 6LoWPAN: IPv6 over Low-Power Wireless Personal Area Networks is an IETF standard to deliver IPv6 connectivity over non-IP networking technologies such as NFC and LoRa using extremely low power, such that compliant devices can potentially run for years on battery power. – OneM2M: a machine-to-machine service layer that can be embedded in hardware and software to connect devices. – Random Phase Multiple Access (RPMA): a proprietary standard for connecting IoT objects. – Sigfox: a proprietary low-power, low-throughput technology for IoT and machine-to-machine (M2M) communications. 111 112 113 114 http://www.etsi.org/ https://www.ietf.org/ https://www.iso.org https://www.gartner.com/doc/3762285/hype-cycle-iot-standards-protocols 41