## 4 Related Work
First, the long-term barrier reported by the Ponemon Institute [19], namely that organizations should consider nurturing more robust risk cultures internally around their IoT environment, reflects our survey result related to the \"IoT security training and awareness plan\" control of the IoTSRM2 (see Figure 13). Second, the finding reported by the Ponemon Institute [19] that very few organizations actively engage in third party IoT security audits is in line with our survey result on the \"IoT supplier contract management plan\" control of the IoTSRM2 (see Figure 13). Third, the finding reported by the Ponemon Institute [19] on IoT applications inventory, namely the prevalent issue of maintaining a comprehensive and relevant inventory of IoT applications, reflects our survey result on the \"IoT software assets inventory\" control of the IoTSRM2 (see Figure 13). Finally, the two findings reported by the Ponemon Institute [19] on resource allocation, namely the budget and staffing shortfalls to manage third party IoT risks, reflect our survey result on the \"IoT supply chain risk assessment\" control of the IoTSRM2 (see Figure 13). Then, regarding the study carried out by Palo Alto Networks [15], it reported four findings that resemble four of our survey results on the IoTSRM2 controls for the surveyed organizations (see Section 3.1.2). First, the finding reported by Palo Alto Networks [15]that organizations lack IoT device inventory is in line with our survey result on the \"IoT hardware assets inventory\" control of the IoTSRM2 (see Figure 12). Second, the finding reported by the Palo Alto Networks [15] that medical IoT devices run on outdated and End of Life operating systems is in line with our survey result on the \"IoT End-of-Life plan\" control of the IoTSRM2 (see Figure 12). Third, the finding reported by the Palo Alto Networks [15] about the necessity of an effective IoT security strategy for managing IoT risk proactively, resembles our survey result that most of our surveyed organizations underperform in strategizing governance and risk management for their IoT infrastructures (i.e., except for vulnerability management) (see Figure 12). Third, the finding reported by the Palo Alto Networks [15] that most organizations do not manage the risk profiles of their IoT devices is somehow in line with our survey result that most of our surveyed organizations are not so much engaged in all-encompassing IoT threat profiling activities, which corresponds to the \"Assessment-based IoT threat identification\" control of the IoTSRM2 (see Figure 12). Afterwards, regarding the study conducted by Arm Limited [32], it reported one finding that resembles one of our survey results on the IoTSRM2 controls for the surveyed organizations, one finding that resembles one of our survey results on the IoTSRM2 compliance score of each of the surveyed organizations, and two findings that somehow resemble one of our survey results on the IoTSRM2 controls for the surveyed organizations (see Section 3.1.2). First, the second top IoT security challenge reported by Arm Limited [32], namely the lack of IoT security understanding and expertise, reflects our survey result related to the \"IoT security training and awareness plan\" control of the IoTSRM2 (see Figure 12). Second, the finding reported by Arm Limited [32] that IoT security implementation scales with the size of the organization is in line with our survey finding that the top three highest and lowest IoTSRM2 compliance scores for the surveyed organizations correspond to large (i.e., except for one of them) and small-medium organizations, respectively (see Figure 14).