## 2 Materials and Methods
### Our Survey Methodology
#### 2.2.1 Phase I: Plan and Create

Table 3: Cont. Furthermore, Table 4 outlines the selected answer format for the 30 IoTSRM2-related questions. This table lists four possible answers, and it gives, for each possible answer, the description of each answer choice and the corresponding percentage score that provides a means to quantitatively rate that answer choice for quantitative analysis of survey responses. Hence, the answer format of our IoTSRM2-related questions is a four-point Likert scale with the answer choices \"No, to a great extent\", \"No, to a certain extent\", \"Yes, to a certain extent\", and \"Yes, to a great extent\", where the middle point is deliberately excluded to avoid indecisive answers [23]. Moreover, these possible answers are designed for survey respondents to rate the extent to which their organizations or client organizations meet each of the IoTSRM2-related questions by selecting one of these answer choices for each of these questions. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Possible Answer** & **Description** & **Percentage Score** \\ \hline No, to a great extent & The organization’s current control deviates from the expected IoTSRM2 control with major discrepancies. & 0\% \\ \hline No, to a certain extent & The organization’s current control nearly deviates from the expected IoTSRM2 control with some similarities. This current control state varies across surveyed organizations having a tendency towards deviating from the “as-is” & 30\% \\ No, to a certain extent & IoTSRM2 control, which may average around 25\% and considers an additional tolerance of 5\% to avoid & \\ \hline Yes, to a great extent & The organization’s current control fairly meets the expected IoTSRM2 control with minor discrepancies. This current control state varies across surveyed organizations having a tendency towards meeting the “as-is” IoTSRM2 control, which may average around 75\% and considers a negative tolerance of 5\% to avoid favoring the associated percentage score too much. & 100\% \\ \hline Yes, to a great extent & The organization’s current control fully meets the expected IoTSRM2 control with no apparent discrepancies. & 100\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The answer format of our IoTSRM2-related questions. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Question ID** & **Question** & **IoTSRM2 Control ID** \\ \hline Q32 & Does the organization keep an up-to-date documented IoT supply chain risk management plan that is aligned with its broader cyber supply chain risk management program and formally approved, and contract only IoT suppliers that maintain robust cyber supply chain risk management plans covering their whole IoT supply chains? & SC.A.1 \\ \hline Q33 & Does the organization regularly assess and record IoT supply chain risks across its supply chain ties based on its IoT supply chain risk management plan, and work only with IoT suppliers that continuously or regularly assess their cybersecurity and privacy supply chain risks and are transparent about their findings? & SC.A.2 \\ \hline Q34 & Does the organization keep an up-to-date documented IoT supplier contract management plan that is aligned with its broader cyber supply chain risk management program and formally approved, and work only with IoT suppliers that maintain robust supplier contract management plans and are transparent about relevant supply chain changes? & SC.B.1 \\ \hline Q35 & Does the organization keep, as part of its IoT supplier contract management plan, up-to-date documented IoT trustworthiness requirements (i.e., cybersecurity, privacy, safety, reliability, and resiliency) for its IoT supplier contracts, and contract only IoT suppliers that deliver up-to-date cybersecurity bills of materials (CBOMs) for the IoT products they provide and have IoT supplier contracts that enable IoT supply chain of trust? & SC.B.2 \\ \hline \hline \end{tabular}
\end{table}