• ​​Professionals who focus on application systems and business logic design can make use of this security reference to tailor security recommendations.
• Manufacturers of IoT devices who lack access to security expertise can use the reference architecture to design the security features for devices.
• Government agencies or business organisations who have responsibilities related to designing and integration of IoT systems.
• IoT developers who want to design, develop and deploy secure IoT products and systems. Examples of developers include solution architects, programmers, manufacturers and system integrators etc.
• IoT service providers who need to roll-out, configure, operate, maintain and de-commission IoT systems securely. Examples of providers include network operators, platform providers, data analysts and service delivery managers etc.
• Users who want to procure or engage in interactions with IoT systems. For system interactions, IoT users can be either human or software agents.​

• ​Discussion on security challenges for the deployment of large scale IoT applications like in smart cities; 
• Discussion on methodologies for performing risk analysis based on standard practices;
• Discussion on the fundamental perspectives in designing security reference architectures;
• Identification of generic “critical activities” in IoT systems based on Activity-centric view;
• Design of generic IoT security reference architecture in line with standards and best practices;
• Categorization of High-Medium-Low security levels for appropriate control measures in IoT;
• Guidelines to tailor security recommendations based on impacts identified through risk assessment; 

Zero Trust Principle: The distributed, open and porous nature of IoT fabric does not allow valid assumptions to be made on the operating environment of IoT systems. As such, the zero-trust principle becomes a key tenet in securing IoT applications. The proposed IoT security reference architecture design is therefore based on an Open system model with security features being driven by the underlying principle of zero trust.

Activity-centric view: Represents the context of system components important to understand for end-to end security implementation and helps in identification of nodes vis-à-vis activities where sensitive IoT application data are stored and processed.

I​oT systems cannot depend on constant system integrity of individual connected devices to ensure the ongoing integrity of the whole system. Individual devices might be compromised but the system should still function properly, if the number of compromised devices is within a predetermined threshold. It is thus important to identify areas of the system which, if compromised, will lead to negative impacts on the entire system.

For brevity, we define such areas as “critical nodes” (and activities performed on these nodes are referred to as “critical activities”) of the system and recommend special attention to the protection of the proper functioning of these nodes and activities.