## 3 Results
### Results for Surveyed Large and Small-Medium Organizations
#### 3.1.2 Results for Part II of Our IoTSRM2 Survey
Therefore, considering where the heavy concentrations of the survey responses are across the two groups of answer choices for each IoTSRM2 control and related question, the majority of the surveyed organizations resulted in having the highest performance in the \"Risk Assessment\" and \"Business Environment\" domains, in that order, whereas the majority of the surveyed organizations resulted in having the lowest performance in the \"Asset Management\", \"Risk Management Strategy\", \"Supply Chain Risk Management\", and \"Governance\" domains, in that order. First, with respect to the \"Risk Assessment\" domain, except for the \"Assessment-based IoT threat identification\" control, the majority of the survey responses are \"Yes, to a certain extent\" and \"Yes, to a great extent\" for the corresponding IoTSRM2 controls (i.e., \"Disclosure-based IoT vulnerability discovery\", \"Assessment-based IoT vulnerability discovery\", \"Intelligence-driven IoT threat identification\", \"IoT risk identification and analysis\", and \"Cybersecurity risk register and IoT risk responses\") and related questions. This result shows that, although most of the surveyed organizations are not so preoccupied with undertaking comprehensive IoT threat profiling exercises, these organizations do engage in IoT risk assessments. Second, about the \"Business Environment\" domain, while most of the survey responses are \"No, to a great extent\" and \"No, to a certain extent\" for the \"Criticality and impact analysis\" control and related question, most of the survey responses for the \"Resiliency requirements\" control and related question are \"Yes, to a certain extent\" and \"Yes, to a great extent\". On the one hand, our finding suggests that most of the surveyed organizations are not so preoccupied with prioritizing IoT related assets based on their criticality to the organization, which may indicate that most surveyed organizations adopt one-size-fits-all approaches in defending IoT enabled services and enablers. On the other hand, our finding shows that the majority of the surveyed organizations are very preoccupied with improving the resilience of their IoT infrastructures, which may suggest that most surveyed organizations focus on securing their IoT infrastructure resilience to compensate for their intake of IoT security and privacy risks. Then, with respect to the \"Asset Management\" domain, the majority of survey responses are \"No, to a great extent\" and \"No, to a certain extent\" for both corresponding IoTSRM2 controls (i.e., \"IoT hardware assets inventory\" and \"IoT software assets inventory\") and related questions. This result shows that most of the surveyed organizations lack all-encompassing IoT asset inventories, which may exacerbate shadow IoT in these organizations and diversify the unknown attack vectors for these organizations. Afterwards, with respect to the \"Risk Management Strategy\" domain, the majority of survey responses are \"No, to a great extent\" and \"No, to a certain extent\" for both corresponding IoTSRM2 controls (i.e., \"IoT security risk appetite and tolerances\" and \"Context-informed IoT security risk tolerances\") and related questions. This finding suggests that most surveyed organizations adopt either one-size-fits-all or ad hoc approaches in managing their IoT security and privacy risks which may drive deep disproportionalities or inefficiencies and inconsistencies in the execution of their IoT security risk management strategies, respectively. Subsequently, with respect to the \"Supply Chain Risk Management\" domain, the majority of survey responses are \"No, to a great extent\" and \"No, to a certain extent\" for all four corresponding IoTSRM2 controls (i.e., \"IoT supply chain risk management plan\", \"IoT supply chain risk assessment\", \"IoT supplier contract management plan\", and \"IoT trustworthiness requirements\") and related questions.