In a smart city environment, various IoT devices are deployed to monitor traffic, manage energy consumption, and enhance public safety. However, these devices are susceptible to security threats such as unauthorized access and data breaches. A city planner is tasked with implementing a security framework that ensures the confidentiality, integrity, and availability of the data collected by these devices. Which security model should the planner prioritize to effectively mitigate risks associated with IoT devices while ensuring compliance with regulations such as GDPR and NIST guidelines?