# Towards a Maturity Model for IoT Adoption by B2C Companies
## 4 Identified Dimensions from the Literature Analysis
### Security and Privacy  
The most frequently mentioned and thoroughly discussed issue is information security and privacy. Microsoft reports that 97% of companies adopting IoT are worried about the question of security [22]. IoT providers are focused on developing and introducing enhanced product functions and interconnectivity, while poorly regarding the concerns of cyber security and protection of consumers' data [33]. [PERSON], [PERSON], [PERSON], [PERSON] [23] state that users' both real and perceived fear of cyber risk is one of the most serious obstacles to market adoption of IoT products and services. IoT devices are able to autonomously collect various data and transfer it to the Internet, enabling live analytics in this manner. Data collected from users might include information about an individual's health, their shopping preferences and history, location, financial data and etc. [28]. Undoubtedly, potential users are deeply concerned with the possibility of such information being leaked or stolen, which negatively impacts their willingness to make use of IoT technology. [PERSON] and [PERSON] [24] distinguish four categories of privacy concerns in an IoT context: collection, unauthorised secondary use, improper access, and errors. [PERSON] et al. [23] discuss the concept of perceived cyber-security risk and propose an Iceberg model to break down the flow of the IoT products development, deployment, and improvement taking into account the question of cyber security. The visible part of the iceberg above the water surface represents the way market adoption benefits product development, but for the sake of addressing the question of the impact of cybersecurity on the IoT product attractiveness, the focus here is on the bottom part of the model, i.e., part of the iceberg hidden under the water. The authors argue that the unwillingness to adopt a certain product might be caused by some factors located \"below the surface\". That is, the growth of the market size leads to hackers becoming more attracted to the product, which in turn increases the probability of cyberattacks being successful. Cyber-risk exposure is one of the components of users' perception of security and reliability, so it significantly affects how beneficial they think IoT product is. If the perceived risk outweighs perceived benefits potential customers will choose not to adopt the product. The authors further discuss that organisations face a choice when dealing with the issue of perceived cyber risk. It boils down to two options: either starting to invest in developing cybersecurity capabilities right from the design stage of IoT product development, or acquiring them when the product is already on the market and the company has been receiving stable revenues. Findings in this study show that organisations investing in cybersecurity from the very beginning are less likely to be attacked by hackers and also enjoy a higher level of perceived reliability from the consumers' side. However, this option might not be available for start-ups, which only control limited financial, human and time resources. To tackle the issue of information privacy and protection, [PERSON] (2017) stresses that IoT providers must clearly communicate the terms and conditions of the use of their products and services to the consumers so that the use of their information is clearly understood. Moreover, [PERSON] [38] explains that risks related to the IoT adoption have to be identified together with their livelihoods, the potential impact must be determined, and based on that, measures to reduce the risk and impact must be developed. In addition, [PERSON] and [PERSON] [24] summarise three types of guarantees that should be offered to end users: awareness of the privacy risks related to the use of IoT products, individual control over the collection and processing of personal information by smart objects; and awareness and control of subsequent use of personal information by external parties.