An organization has decided to implement a new Internet of Things (loT) solution. Which of the following should be done FIRST when addressing security concerns associated with this new technology?

When introducing a new technology like IoT, the first step is to identify and develop new risk scenarios specific to that technology to understand the unique threats, vulnerabilities, and potential impacts before implementing any controls or monitoring.

Implementing IoT device monitoring software is a control measure that should follow an understanding of the specific risks identified during a risk assessment.

Introducing controls without first comprehensively understanding the specific new threat environment and associated risks introduced by IoT can lead to ineffective or misdirected security efforts.

Engaging external security reviews is a valuable step for validation or specialized expertise, but it typically occurs after initial internal risk identification and assessment have been performed.