## 3 Results
### Results for Surveyed Large and Small-Medium Organizations
#### 3.1.2 Results for Part II of Our IoTSRM2 Survey
This finding of our survey suggests that most surveyed organizations do not actively assess their IoT supply chain risks across several supply chaintiers, which may not only hinder their ability to adequately enforce a base level of trust across their supply chain but also diminish their ability to rapidly identify and mitigate the IoT security-related risks stemming from their supply chain. In this context, the majority of surveyed organizations should consider fast-tracking the improvement of their capabilities related to the \"IoT security training and awareness plan\", \"IoT supplier contract management plan\", \"IoT End-of-Life plan\", \"IoT software assets inventory\", and \"IoT supply chain risk assessment\" controls of IoTSRM2. Moreover, to allow for better prioritization of effort, the surveyed organizations should consider improving these capabilities in tandem with their capabilities related to the \"Criticality and impact analysis\" of the IoTSRM2. **Weighted Results on IoTSRM2 for Surveyed Organizations**  
Then, Section 3.1.2 provides the key results on the entire IoTSRM2 for the surveyed organizations by outlining the degree of compliance of each of these organizations with the IoTSRM2. The IoTSRM2 compliance score for each surveyed organization resulted based on all survey responses of that surveyed organization and the IoTSRM2 adjusted control weights for each of the IoTSRM2 controls and related questions. It is worth noting that the IoTSRM2 compliance score for each surveyed organization is calculated using Equation (4) (see Section 2.2.3). Furthermore, for each of the surveyed organizations from each of the four regions of the world considered in our IoTSRM2-based survey, Figure 14 shows the corresponding IoTSRM2 compliance score and indicates whether this score is less than 50% or greater than or equal to 50%. It is worth noting that each surveyed organization is uniquely identified using our proposed naming convention (see Section 2.2.3) which allows readers to differentiate surveyed organizations from each other and to determine the organization category and industry classification of each surveyed organization from its name. Thus, the top three highest IoTSRM2 compliance scores correspond to one large organization (i.e., LG.PSO.3) from the \"North/South America\" region, one large organization (i.e., LG.E&U.3) from the \"Asia\" region, one large organization (i.e., LG.TMT.3) from the \"North/South America\" region, and one small-medium organization (i.e., SM.EDU.1) from the \"North/South America\" region, in that order, whereas the top three lowest IoTSRM2 compliance scores correspond to one small-medium organization (i.e., SM.TMT.5) from the \"Europe, Middle East and Africa (EMEA)\" region, one small-medium organization (i.e., SM.GOV.1) from the \"North/South America\" region, and one small-medium organization (i.e., SM.TMT.1) from the \"Europe, Middle East and Africa (EMEA)\" region, in that order. About the surveyed organizations that have the top three highest IoTSRM2 compliance scores, these results show that except for LG.E&U.3, all organizations are from the \"North/South America\" region. Moreover, except for SM.EDU.1, all surveyed organi  
Figure 14: The IoTSRM2 compliance of surveyed organizations. zations that have the top three highest IoTSRM2 compliance scores are large organizations. As for the surveyed organizations that have the top three lowest IoTSRM2 compliance scores, these results show that except for SM.GOV.1, all organizations are from the \"Europe, Middle East and Africa (EMEA)\" region. Moreover, all surveyed organizations that have the top three lowest IoTSRM2 compliance scores are small-medium organizations.