## 3 Materials and Methods  
Our study focused on university bachelor and masters students (Technical University of Munich, TUM) during their study programs, where all survey participants were registered for comparable interdisciplinary information systems lecture courses. The online survey was conducted in July 2021, during which time students had been assigned practical tasks as part of the courses, which included a limited number of research-related activities. The SoSci survey platform ([[https://www.soscisurvey.de/en/](https://www.soscisurvey.de/en/)]([https://www.soscisurvey.de/en/](https://www.soscisurvey.de/en/)) (first accessed for this project on 20 June 2021)) was selected for the survey based on the data protection arrangements of this survey site. Each survey participant could selectbetween two options, completing the survey as a work experience student or as a student without work experience. Students were asked to classify themselves as those with remote work experience if they had any remote work experience since March 2020 (start of the pandemic), including their current work experience (see Appendix B). Remote work was defined as an arrangement in which employees do not commute or travel to a central place of work, such as an office building or other facility. Work experience could include part-time or full-time work, internship or any other work-related activity. Students were asked to self-categorize as those without remote work experience if, since March 2020 (start of the pandemic), they had no remote work experience at all. The online survey was structured into five distinct sections; four related to cyber-security risks, and the fifth related to demographics. Demographic questions covered age, work or study location, work-related role and the length of experience plus other details. Each of the four cyber-security-related topics, i.e., (1) covering remote work and study with Wi-Fi settings, (2) smart home device usage, (3) BYOD and personal device usage, and (4) cyber-security-related social engineering threats, had ten to fifteen questions. We approached each of the four broad topics with a distinct block of questions; however, with a consistent structure. First, we inquired about formal organizational policy expectations, including policies or guidelines. Organizational policy was defined as company or corporate policy for those who completed the survey as a work experience student and university policy for those who completed the survey as a student without work experience. Second, we asked for the expected level of support needed in the given topic space in order to understand if the level of current support was sufficient or additional support was needed. Third, we asked participants to describe the possible technology guidance that they would need or information about technologies they would potentially try themselves. This would include targeted training courses or case studies and utilization of organizational technology solutions for personal use. Fourth, we assessed the actual security practices through detailed technology questions. Depending on the topic block, we asked for details such as password management, reporting of unusual emails and phone calls, practices for managing application and smartphone apps, or the management of smart home devices. All survey participants were informed about the survey procedure and data privacy details and explicitly asked to give consent of their agreement to those details (see Appendix A). Those participants who did not agree with the consent form or did not fully complete the survey were removed from the dataset, and their data were not part of any further analysis. Completion of the survey was voluntary but incentivized as part of a series of tasks awarding a grade bonus for the final exam. Threats to validity were evaluated for a number of topics to avoid potential bias in the collection, processing and evaluation of data.