The Internet of Things (IoT) paradigm with its vast range of heterogeneous connecting technologies heralds a new era for internet research, especially given that this explosion in connectivity for devices or `things' is not without risk. Scholars recognise that IoT security concerns persist and that evidence highlighting increasing cyber-security vulnerabilities requires attention. Currently IoT security literature confirms: industry confusion, lack of clear standards, interoperability fears and security problems (with reference to identity, authentication, access control, protocol and network security, privacy, and trust and governance difficulties all within the IoT technology realm). In short, there is urgent need for governance in IoT to avoid unstructured fragmentation of architectures, protocols and identification systems, and responsibilities. To address anticipated future numbers of IoT devices, a secure, scalable, yet flexible solution is needed to work across a range of technologies and dynamic environments. Specific industries such as the Western Australian (WA) Mining and Resource sector, whilst recognised as an early adopter of technology/ IoT applications, is also currently seeking security solutions that provide competitive advantage. To this end, the research being conducted here is utilising qualitative methodologies (alongside document analyses), and specific real-world/live case-studies towards relevant organisations' IoT cyber-security decision making, with a view to developing best-practice cross-party guidance(s). Work here is at its early stages; ultimately variables identified and subsequently validated shall go towards a new developed design guide for the deployment of Information Technology/ Operational Technology and IoT environments, to address IoT security concerns, applicable to (major WA mining and resources companies and) the energy and resources generally.