## 2 Materials and Methods
### Our Survey Methodology
#### 2.2.1 Phase I: Plan and Create  
The \"Plan and Create\" phase involves the definition of methodology objectives, survey assumptions, and limitations (Step I.1), the development of the questionnaire for our IoTSRM2-based survey (Step I.2), and the design and creation of our IoTSRM2-based survey (Step I.3). **Step I.1: Define methodology objectives, survey assumptions, and limitations**  
First, this step outlines the twelve objectives of our proposed methodology. Thus, the main objective of the proposed methodology is:  
* **Objective 1:** Run an online anonymous survey for four weeks based on the web survey design principles [20] and IoT Security Risk Management Strategy Reference Model (IoTSRM2) (see Section 2.1) targeting leaders with stake in IoT security risk management strategies from industries and governments from around the world to determine the current state of IoT security risk management strategies in the surveyed organizations relative to the IoTSRM2. Then, the secondary objectives of the proposed methodology are:
* **Objective 2:** Identify target groups of survey respondents to get the views of leaders from industries and governments on the IoT security risk management strategies of their organizations or client organizations relative to the IoTSRM2;
* **Objective 3:** Organize the questionnaire of our IoTSRM2-based survey in two parts, including screening and background questions for part I of and IoTSRM2-related questions for part II of our IoTSRM2-based survey;  
Figure 4: Our proposed three-phased survey methodology. * **Objective 4:** For part I of our IoTSRM2-based survey, formulate the screening and background questions with associated answer choices for each question to allow filtering and anonymous profiling of survey respondents and surveyed organizations;
* **Objective 5:** For part II of our IoTSRM2-based survey, formulate one IoTSRM2-related question with associated answer choices for each of the 30 IoTSRM2 controls (see Section 2.1) from our previous paper [14] to allow the determination of the current state of IoT security risk management strategies in the surveyed organizations based on IoTSRM2;
* **Objective 6:** Identify the principles for designing web questionnaires [20] that are applicable to our IoTSRM2-based survey to allow its corresponding design based on web survey design principles;
* **Objective 7:** Define the criteria for selecting an online survey tool that is fit for running our IoTSRM2-based survey;
* **Objective 8:** Develop the survey analysis plan for our IoTSRM2-based survey to focus the analysis of the survey responses on our research questions;
* **Objective 9:** Set up our IoTSRM2-based survey using the selected online survey tool to meet the applicable survey design principles and to include our questionnaire;
* **Objective 10:** Identify the target survey respondents that belong to the target groups of survey respondents and create social media posts and private messages that are aimed at increasing the survey response rate to request participation in our IoTSRM2-based survey;
* **Objective 11:** Send requests and reminders for survey participation through different distribution channels, including e-mail and social media (i.e., LinkedIn and Twitter);
* **Objective 12:** Analyze the collected survey responses based on our survey analysis plan and report our survey results for part I and II of our IoTSRM2-based survey for all surveyed organizations, the surveyed organizations of the top organization type by survey respondents, and the surveyed organizations from the top industry sector of the top organization type by survey respondents. Furthermore, this step provides the assumptions on which our survey is based. These assumptions are split in two types: the underlying assumptions of the IoTSRM2 and the survey methodology assumptions.