## 4 Related Work
**E5: Provides results for organizations from a specific industry sector**  
Our IoTSRM2-based survey study provides the percentage distribution of the surveyed organizations by industry classification/sector (see Section 3.1.1), the IoTSRM2 compliance score of each of the surveyed organizations together with indicating the industry sector of that organization (see Section 3.1.2), the percentage distribution of the surveyed large organizations by industry classification/sector (see Section 3.2.1), and the IoTSRM2-based survey results on the surveyed large TMT organizations (see Section 3.2.3). In addition, from the 12 reviewed related works, four of them provided some of their survey results for organizations from a specific industry sector (i.e., [15; 35; 37; 40]), whereas the remaining ones did not provide any results for organizations from a specific industry sector (i.e., [31; 32; 33; 34; 36; 38; 39]). With respect to the four reviewed related works that provided results for organizations from a specific industry sector, Palo Alto Networks [15] provided their results for the enterprise IT and healthcare industry sectors and some of these results are mainly focused on the organizations from the healthcare industry sector, Forescout Technologies [35] provided all their findings for specific industry verticals, IBM [37] provided all their results for the electronics industry sector, and UL [40] provided some of their results for organizations from specific industry sectors (e.g., IoT security plan). **E6: The results reveal the level of compliance of each subject with a reference model**  
As per Table 10, none of the 12 reviewed related works provided results that reveal the level of compliance of the subjects with a reference model. However, the SANS Institute [39] meets this evaluation criterion to a certain extent. This is because the SANS Institute [39] provided merely the overall results for their survey respondents that indicate percentage scores of the IIoT devices connecting to different levels and zones of the network infrastructure following the Purdue model hierarchy rather than reporting the level of compliance of each subject with the Purdue model. Compared with the 12 reviewed related works, our IoTSRM2-based survey study outlines the degree of compliance of each of the surveyed organizations with the IoTSRM2 (see Section 3.1.2) and provides the IoTSRM2 compliance score for each of the surveyed organizations (see Figure 14). **E7: The findings resemble the results of our IoTSRM2-based survey**  
This article provides our IoTSRM2-based survey results for each of the three groups of surveyed organizations (i.e., the surveyed large and small-medium organizations, the surveyed large organizations, and the surveyed large TMT organizations). As per Table 10, none of the reviewed related works reported findings that fully resemble the results of our IoRSRM2-based survey. However, eight of the reviewed related works, namely Palo Alto Networks [15], the Ponemon Institute [19], Arm Limited [32], Gemalto [36], IBM [37], Juniper Networks [38], the SANS Institute [39], and UL [40], reported one or more findings that resemble some of our survey results, while the remaining ones (i.e., [31; 33; 34; 35]) did not report any findings that resemble our survey results. With respect to the eight reviewed related works that meet this evaluation criterion to a certain extent, the Ponemon Institute [19] reported five findings, Palo Alto Networks [15], Arm Limited [32] and the SANS Institute [39] each reported four findings, Gemalto [36] and IBM [37] each reported two findings, and the remaining two research studies (i.e., [38; 40]) reported one finding that resemble some of our survey results. Hence, with respect to the study conducted by the Ponemon Institute [19], it reported five findings that resemble four of the weighted results of our IoTSRM2-based survey on the IoTSRM2 controls for the surveyed organizations (see Section 3.1.2).