## 4 Related Work
Finally, UL [40] focused their survey study on determining how the organizations are preparing for and responding to the current and emerging IoT security threats. Then, about the two reviewed related works that focused on determining the current state of IIoT security in organizations, IBM [37] determined the IIoT security risks and their implications for the surveyed organizations from the energy and industrial sectors, and the SANS Institute [39] investigated the capabilities, threats, and risks of IIoT security in surveyed organizations. With respect to the two reviewed related works that focused on determining the current state of IoT security for consumers, [PERSON] and [PERSON] [31] studied the security and privacy concerns of their survey respondents about the smart home devices in the Saudi Arabia, and the Cabinet Office [34] investigated the consumer attitudes towards IoT security. Furthermore, the Ponemon Institute [19] focused on determining the current state of third party IoT risk management in surveyed organizations. Compared with these 12 reviewed related works, our IoTSRM2-based survey study is focused on determining the current state of IoT security risk management strategies in the surveyed organizations relative to the IoTSRM2. **E2: The methodology for achieving the intended purpose of the research study is clearly described**  
Our proposed three-phased methodology for achieving the intended purpose of this IoTSRM2-based survey study, namely determining the current state of IoT security risk management strategies in the surveyed organizations relative to the IoTSRM2, is clearly described (see Section 2.2). Our methodology includes nine steps and outputs related to the plan and create, launch and run, and analyze and report phases. Furthermore, from the 12 reviewed related works, one of them clearly described the methodology used for achieving the intended purpose of the research study (i.e., [35]), five of them partially described their methodology (i.e., [31; 32; 33; 34]), while the remaining ones did not describe their methodology (i.e., [36; 37; 38; 39; 40]). Regarding the related work that clearly described its methodology, Forescout Technologies [35] provided the methodology applied for determining the state of enterprise IoT network security of some of their customer deployments by outlining three main steps, namely data collection, data cleaning and enrichment, and data analysis. Furthermore, Forescout Technologies [35] provided details about the risk score model created and used to measure the risk values for all IoT devices of some of their customer deployments, which were then used to analyze the anonymous enterprise device data from the Forescout Device Cloud. In contrast with the research work performed by Forescout Technologies [35] which entails an experimental study that processes data from some of their customer deployments, our proposed methodology from this article involves a survey-based study that leverages the survey data drawn from the survey respondents on the surveyed organizations. Although our proposed methodology from this article has different objectives than the study conducted by Forescout Technologies [35], similar to the methodology of Forescout Technologies [35] which includes, among others, data collection, data cleaning, and data analysis steps for anonymous data, our proposed three-phased methodology includes, among others, steps that entail the collection, cleaning and analysis of anonymous data as part of the launch and run, and analyze and report phases. Furthermore, from the perspective of the extent of applicability to this evaluation criterion, our proposed methodology differentiates from the methodologies provided by Palo Alto Networks [15], Almutairi and [PERSON] [31], Arm Limited [32], [PERSON] and [PERSON] [33], and the Cabinet Office [34], as it is much more detailed than the ones of these five reviewed related works which offer limited details.