Systematization of human-centered continuous audit for IoT security compliance

Abstract

The promise of automated compliance is falling short of its real-world potential. Although extensive research has proposed many automated compliance solutions, real-world adoption shows that only 18% of organizations have implemented them. This implementation gap is especially critical in Internet of Things (IoT) environments, where even small and medium-sized business networks can see hundreds of distinct IoT devices over short period of time, rendering traditional manual auditing methods quickly overwhelmed. This study seeks to understand this implementation gap by clarifying why auditors struggle to use automated auditing tools and identifying the conditions under which adoption succeeds. In doing so, it contributes to the field of auditing by helping shift automation approaches from prototypes into used instruments that enhance security assurance in increasingly complex environments such as IoT. We propose a systematic mapping of literature relevant to technologies used for computer-assisted audit tools, from rule-based checking to artificial intelligence-powered approach. From this mapping, we introduce a human-centered auditing framework that maps the research landscape to the three core stages of human auditor workflow: planning, verification, and reporting. We use this framework to assess the state-of-the-art in IoT security compliance audit, revealing critical misalignments between technological capabilities and auditor requirements. In each workflow stage, we categorize and systematize key technologies which researchers are uniquely positioned to advance. Finally, we present a research roadmap that enables security researchers to build on strong academic foundations and meet the practical need of continuous IoT security auditing.