Integrated Cybersecurity Risk Assessment and Threat Modelling Framework (ISACRATF) for Smart Agriculture in South Africa and Sub-Saharan Africa

Smart agriculture Internet of Things (IoT) systems are being deployed across South Africa and Sub-Saharan Africa faster than they are being secured, yet available security methods separate threat identification from risk quantification and assume the reliable power, connectivity and expertise of high-income settings. Following the Design Science Research Methodology, this study derived eight design requirements and constructed ISACRATF, an integrated six-phase framework that couples STRIDE-LM threat modelling to a Context-Adjusted Risk Engine (CARE). CARE amplifies a conventional likelihood–impact score by a bounded, transparently weighted factor built from five regional conditions: connectivity fragility, power instability, skills scarcity, supply-chain and device heterogeneity, and socio-economic criticality. Prioritised threats are then mapped to controls tiered by resource intensity. Demonstration on an assumed South African mixed-farm case showed that context re-orders risk priorities rather than inflating them uniformly: a denial-of-service threat moved from a three-way tie into the Critical band, and a spoofing threat rose from Medium to High. Because CARE reports base and adjusted scores side by side, the effect of context is explicit and auditable. Expert and field evaluation of the framework is reserved for future research.