## 2 Materials and Methods
### Our Survey Methodology
#### 2.2.1 Phase I: Plan and Create
First, the underlying assumptions of the IoTSRM2 are listed below:  
* \"The cybersecurity risk management practices of IoT adopters prior to their IoT adoption and irrespective of their IoT security practices, are assumed to be agile and risk-informed, namely appraised at Tier 4 (Adaptive) of NIST CSF's Tiers [21]\" [14];
* \"IoT adopters are assumed to outsource IoT software development and not engage in in-house IoT software development activities\" [14];
* \"IoT adopters are assumed to have contracted IoT suppliers and conducted third-party IoT security due diligence reviews covering premarket IoT security related activities ahead of contracting IoT suppliers\" [14]. Second, the assumptions on which the proposed survey methodology is based are listed below:
* Our survey respondents are assumed to provide genuine responses about the surveyed organizations;
* The underlying assumptions of the IoTSRM2 are assumed applicable for the surveyed organizations. In addition, Step I.1 provides the limitations of our methodology and survey. These limitations are enumerated below:  
* The proposed survey methodology is derived, based on, and limited to our professional judgement, IoT Security Risk Management Strategy Reference Model (IoTSRM2), and the selected survey design best practice;
* Our IoTSRM2-based survey is derived based on, and limited to, our survey methodology;Our IoTSRM2-based survey is limited to our survey methodology assumptions and the underlying assumptions of the IoTSRM2;  
Our IoTSRM2-based survey results are limited to the surveyed organizations and to the responses provided by our survey respondents. It is worth noting that any attempt to draw statistical inferences from our survey data about the current state of the IoT security risk management strategies in other organizations than the ones surveyed should be carefully navigated, is subject to survey biases (e.g., non-response bias, self-reporting bias), and is beyond the scope of this article. **Step I.2: Develop the questionnaire for the IoTSRM2-based survey**  
Step I.2 involves the development of the questionnaire for our IoTSRM2-based survey, which relies on the 30 IoTSRM2 controls (see Section 2.1) from our paper on the IoTSRM2 [14]. Thus, our questionnaire is divided into two parts. Part I includes five screening and background questions and part II includes 30 IoTSRM2-related questions. Both parts of our questionnaire contain only closed-ended questions. With respect to part I of our IoTSRM2-based survey, Table 2 lists the screening and background questions of our questionnaire, and, for each question, it provides the associated possible answers and the justification of question inclusion. These screening and background questions are used to ensure the participation of the right survey respondents to our IoTSRM2-based survey and to allow categorization of the survey responses based on the anonymous profiles of the surveyed organizations. Hence, answering to these questions is a prerequisite for survey respondents to progress to the IoTSRM2-related questions of our IoTSRM2-based survey. Then, with respect to part II of our IoTSRM2-based survey, Table 3 lists the 30 IoTSRM2-related questions of our IoTSRM2-based survey, and, for each IoTSRM2-related question, it provides the unique identifier of that question and the unique identifier of the corresponding IoTSRM2 control. Each of these IoTSRM2-related questions is formulated to cover one