## 4 Related Work
Third, the findings reported by Arm Limited [32] that the majority of their survey respondents (i.e., 53%) are not carrying out threat analysis for all the IoT products they provide, and that nearly all of their survey respondents (i.e., 86%) are likely to do or redo the threat analysis in the postmarket phase of the IoT products they provide, are somehow related to our survey result on the \"Assessment-based IoT threat identification\" control of the IoTSRM2 in the context of perhaps having surveyed organizations that work with IoT suppliers that are not so much engaged in performing thorough IoT threat profiling activities (see Figure 12). Then, about the study conducted by the SANS Institute [39], it reported two findings that resemble three of our survey results on the IoTSRM2 controls for the surveyed organizations, and two findings that somehow resemble two of our survey results on the IoTSRM2 controls for the surveyed organizations (see Section 3.1.2). First, the finding reported by the SANS Institute [39] that most of their respondents (i.e., 59%), regardless of organization size, need additional education and training to manage security of IIoT device, is in line with our survey result on the \"IoT security training and awareness plan\" control of the IoTSRM2 (see Figure 12). Second, the finding reported by the SANS Institute [39] that only 41.1% of their respondents have physical and logical inventory of connected devices to protect against IIoT risks, reflect our survey results on the \"IoT hardware assets inventory\" and \"IoT software assets inventory\" controls of the IoTSRM2 (see Figure 12). Third, the top IIoT challenge reported by the SANS Institute [39], namely the difficulty in or lack of patching for IIoT systems is somehow related to our survey result on the \"Vulnerability disclosure policy\" control of the IoTSRM2 from the perspective that relying on an inadequate or absent vulnerability disclosure policy may favor scenarios where vulnerable IoT systems stay unpatched for longer periods of time (see Figure 12). Fourth, the third top IIoT challenge reported by the SANS Institute [39], namely the difficulty in identifying and managing IIoT connectivity to critical infrastructure and other mission-critical systems is somehow related to our survey result on the \"Criticality and impact analysis\" control of the IoTSRM2 considering that managing IoT interdependencies is cumbersome and inefficient without having all IoT enabled services and enablers prioritized based on their criticality. Furthermore, with respect to the study undertaken by Gemalto [36], it reported one finding that resembles one of our survey results on the IoTSRM2 controls for the surveyed large organizations (see Section 3.2.1), and another that somehow resembles one of our weighted survey results on the IoTSRM2 controls for the surveyed large organizations (see Section 3.2.2). First, considering that the organization size of all survey respondents of Gemalto [36] is greater than 250 employees and corresponds to the surveyed large organizations of our IoTSRM2-based survey study (see Section 2.2), the finding reported by Gemalto [36] that the \"TT, technology and telecoms\" is the top organization sector by survey respondents reflects our survey result on the top industry sector for the surveyed large organizations by survey respondents, namely the \"Technology, Media, & Telecom (TMT)\" industry sector (see Figure 16). Second, the finding reported by Gemalto [36] that the majority of their survey respondents that supply IoT products or services (i.e., 54%) increased their IoT security offerings is somehow related to our survey result on the \"IoT trustworthiness requirements\" control of the IoTSRM2 from the perspective that having better IoT trustworthiness requirements for the IoT supplier contracts may demand and stimulate greater IoT security offerings on the supply side (see Figure 18).