The first thing that should be done when addressing security concerns associated with a new Internet of Things (IoT) solution is to develop new IoT risk scenarios. IoT is a network of physical devices, such as sensors, cameras, appliances, etc., that are connected to the internet and can collect, process, and exchange data. IoT introduces new security concerns, such as privacy, confidentiality, integrity, availability,and accountability of the data and devices, as well as new threats and vulnerabilities, such as unauthorized access, manipulation, or disruption of the data and devices. Developing new IoT risk scenarios is the first thing that should be done, because it helps to identify, analyze, and evaluate the potential risks that could affect the IoT solution’s objectives or operations. Developing new IoT risk scenarios also helps to select the most appropriate and effective controls to minimize the risks, such as avoiding, reducing, transferring, or accepting the risks. The other options are not the first thing that should be done, although theymay be part of or derived from the IoT risk scenarios. Implementing IoT device monitoring software, introducing controls to the new threat environment, and engaging external security reviews are all activities that can help to support or improve the security of the IoT solution, but they do not necessarily identify, analyze, or evaluate the risks that could affect the IoT solution. References = 1