## 2 Materials and Methods
### Our Survey Methodology
#### 2.2.1 Phase I: Plan and Create
\begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Question ID** & **Question ID** & **Possible Answers** & **Justification of Question Inclusion** \\ \hline Q1 & To which organization are you referring when doing this survey? & My organization & The sole purpose of this background question is to enhance our collection of survey responses by targeting two types of survey respondents, namely either those from organizations that adopt IoT technologies or those from organizations that help their client organizations embrace IoT technologies. \\ \hline Q2 & Which of the following best describes your position? & C-level executive and/or board member & \\  & & Consulting practice leader and/or principal & This screening question aims to ensure the survey participation only of the organizational leaders that belong to the four target groups of survey respondents provided as possible answers for this question. It is worth noting that “Other senior position” refers to any other senior position of decision-making individuals. \\ \hline Q3 & What is the category of the organization? & Large Organization & For the purposes of this survey study, the organization type or the organization category is based on the size of the organization, and it can be either a small-medium organization or large organization. Hence, this background question aims to allow a clear delineation between the survey responses related to large organizations and those related to small-medium organizations. It is worth noting that SME denotes an organization having, inter alia, a staff headcount of less than 250 [22]. \\ \hline Q4 & In which industry sector does the organization operate? & Education Energy \& Utilities Financial \& Insurance Services Government Healthcare \\  & & Defeasible Services Technology, Media, \& Telecom Other \\ \hline Q5 & In what region is the organization headquartered? & Asia Europe, Middle East and Africa (EMEA) Noorth/South America Oceania & This background question aims to allow a clear delineation between the survey responses related to the organizations that are headquartered in different regions. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Our screening and background questions with possible answers. of the 30 IoTSRM2 controls introduced in Section 2.1 of this paper and proposed in our previous paper on the IoTSRM2 [14]. Hence, these IoTSRM2-related questions are designed to get the leaders' views on the current state of the IoT security risk management control strategies of their organizations or client organizations against the IoTSRM2 controls. \begin{table}
\begin{tabular}{c p{142.3 pt} p{142.3 pt}} \hline \hline
**Question ID** & **Question** & **IoTSRM2 Control ID** \\ \hline Q6 & Does the organization have a comprehensive situational awareness on all its IoT hardware assets that leverages cybersecurity bills of materials (CBOMs) for all acquired IoT products and integration with its IT asset management processes? & AM.A.1 \\ \hline Q7 & Does the organization have a comprehensive situational awareness on all its IoT software assets that leverages cybersecurity bills of materials (CBOMs) for all acquired IoT products and integration with its IT asset management processes? & AM.B.1 \\ \hline Q8 & Does the organization prioritize all its IoT enabled services (e.g., customer services) and enablers (e.g., IoT components, IoT supply chain) based on their criticality to the organization, using cybersecurity bills of materials (CBOMs) for all acquired IoT products, and leveraging integration with cybersecurity risk management program? & BE.A.1 \\ \hline Q9 & Does the organization keep, as part of its cybersecurity-related plans, up-to-date documented resiliency requirements (i.e., cybersecurity, reliability, continuity, and recovery) for all its mission critical IoT enabled services, and have high confidence in the cyber resilience of its IoT suppliers?