## 3 Results
### Results for Surveyed Large Organizations
#### 3.2.2 Results for Part II of Our IoTSRM2 Survey on Surveyed Large Organizations  
This subsubsection provides our main results for part II of our IoTSRM2-based survey on the surveyed large organizations, including the weighted results on IoTSRM2 controls for the surveyed large organizations. **Weighted Results on IoTSRM2 Controls for Surveyed Large Organizations**  
Section 3.2.2 outlines the key results on the IoTSRM2 controls for the surveyed large organizations by outlining the overall average compliance with IoTSRM2 controls. The overall average IoTSRM2 compliance score for each IoTSRM2 control and related question  
Figure 16: Distribution of survey responses for large organizations by industry classification. Figure 15: Distribution of our survey respondents for large organizations by position level. resulted based on all survey responses for surveyed large organizations and the corresponding IoTSRM2 adjusted control weight for that IoTSRM2 control and related question. It is worth noting that, for each IoTSRM2 control, the overall average IoTSRM2 compliance score is calculated using Equations (1)-(3) (see Section 2.2.3). Furthermore, Figure 18 presents the consolidated view of the survey responses on the surveyed large organizations through the corresponding overall average IoTSRM2 compliance score for each IoTSRM2 control and related question. For each IoTSRM2 control and related question, this figure indicates whether the corresponding overall average IoTSRM2 compliance score leans towards deviating from or meeting the \"as-is\" IoTSRM2 control. Figure 18 shows that the overall average IoTSRM2 compliance score across the surveyed large organizations is marginally greater than 50% for the majority of the IoTSRM2 controls and less than 50% for the remaining ten IoTSRM2 controls. Thus, the \"Resiliency requirements\", \"IoT security operations roles and responsibilities\", \"Cybersecurity regulatory framework\" and \"IoT security policy\" controls resulted in having the top three highest overall average IoTSRM2 compliance scores, in that order, whereas the \"IoT software assets inventory\", \"IoT End-of-Life plan\", \"End-of-Life policy\", and \"IoT hardware assets inventory\" controls resulted in having the top three lowest overall average IoTSRM2 compliance scores, in that order. First, with respect to the top three highest overall average IoTSRM2 compliance scores, these findings suggest that the majority of the surveyed large organizations focus on building more resilient mission critical IoT enabled services, maintain clearly defined IoT security operations roles and responsibilities, are aware of their IoT security and privacy regulatory obligations, and have their top management's commitment towards IoT security articulated through a formal IoT security policy. Second, regarding the top and fourth lowest overall average IoTSRM2 compliance scores, namely for the \"IoT software assets inventory\" and \"IoT hardware assets inventory\" controls, respectively, our survey results show that the majority of the surveyed large organizations do not have a comprehensive situational awareness on their IoT assets. This finding is quite worrying as it suggests that the majority of the surveyed large organizations not only they do not know their whole IoT attack surface but also may not have a clear picture of their cyber threat landscape, which may negatively impact their ability to adequately assess and manage their IoT security and privacy risks and in turn affect their ability to adequately protect their IoT infrastructures and enabled assets. Figure 18: Overall average compliance with IoTSRM2 controls based on the survey responses for large organizations. As for the second and third lowest overall average IoTSRM2 compliance scores, namely for the \"IoT End-of-Life plan\" and \"End-of-Life policy\" controls, respectively, our survey results show that the majority of the surveyed large organizations deviate or nearly deviate from the \"as-is\" corresponding IoTSRM2 controls.