## 5 Conclusions and Future Work  
This article presented our findings following the undertaking of an IoTSRM2-based survey study. These findings rely on the survey responses of leaders from industries and governments from around the world, show the current state of IoT security risk management strategies in the surveyed organizations relative to the IoTSRM2, and aim to support IoT security practitioners to peer benchmark and enhance their IoT security risk management strategies. First, this article introduced the acute need for robust IoT security risk management strategies in organizations embracing IoT technologies, provided the rationale for perform ing the IoTSRM2-based survey study, enumerated the research questions, highlighted the main contributions of our research work, outlined the structure of the article, and provided a reading map for our research questions. Then, the article described our proposed three-phased methodology for addressing the research questions by describing the nine steps of this methodology and their associated outputs. Thus, first, the article described the three steps of the first phase (i.e., the \"Plan and Create\" phase) which allowed, among others, the definition of the methodology objectives, the design and creation of the IoTSRM2-based survey, and development of our survey analysis plan. Afterwards, it described the three steps of the second phase (i.e., the \"Launch and Run\" phase) which enabled, inter alia, the identification of the target survey respondents, the submission of survey participation requests, and the collection of survey responses. Next, it described the three steps of the third phase (i.e., the \"Analyze and Report\" phase) which allowed, among others, the analysis of survey responses and the reporting of survey findings. Subsequently, the article presented our survey results for the three groups of surveyed organizations (i.e., the surveyed large and small-medium organizations, the surveyed large organizations, and the surveyed large TMT organizations). Hence, about the results for all surveyed organizations, first, these results revealed that the \"C-level executive and/or board member\" and \"Consulting practice leader and/or principal\" position levels are the top position levels of the survey respondents for these organizations. Second, our results revealed that the \"Large Organization\" category is the top organization type for these organizations. Third, our results showed that the \"Technology, Media, & Telecom (TMT)\" industry sector is the top industry sector for these organizations. Fourth, these results showed that the \"North/South America\" region is the top region for these organizations. Fifth, about the overall tendency of the IoT security risk management strategies of these organizations relative to the IoTSRM2 controls, our findings suggested, among others, that most organizations do best in the \"Resiliency requirements\" control and they do worst in the \"IoT security training and awareness plan\" and \"IoT End-of-Life plan\" controls. Then, about the overall average IoTSRM2 compliance score of these organizations for each IoTSRM2 control, our findings showed, among others, that most organizations do best in the \"Resiliency requirements\" control and they do worst in the \"IoT security training and awareness plan\" and \"IoT supplier contract management plan\" controls. As for the IoTSRM2 compliance score of each of these organizations, our results revealed, among others, that the top three highest and lowest IoTSRM2 compliance scores for the surveyed organizations correspond to large (i.e., except for one of them) and small-medium organizations, respectively. Furthermore, about the results for the surveyed large organizations, first, these results revealed that the \"Consulting practice leader and/or principal\" position level is the top position level of the survey respondents for these organizations.