## 3 Results
### Results for Surveyed Large Organizations
#### 3.2.3 Results for Surveyed Large Organizations from Technology, Media, & Telecom (TMT)
Hence, the \"IoT security policy\", \"Disclosure-based IoT vulnerability discovery\", \"IoT risk identification and analysis\", \"IoT vulnerability management plan\", \"Assessment-based IoT vulnerability discovery\", \"Context-informed IoT security risk tolerances\", \"IoT trustworthiness requirements\", \"Cybersecurity risk register and IoT risk responses\", \"IoT supply chain risk management plan\", and \"IoT supplier contract management plan\" controls resulted in having the top three highest overall average IoTSRM2 compliance scores, in that order, whereas the \"Criticality and impact analysis\", \"Vulnerability disclosure policy\", \"IoT software assets inventory\", and \"IoT security training and awareness plan\" controls resulted in having the top three lowest overall average IoTSRM2 compliance scores, in that order. First, with respect to the top three highest overall average IoTSRM2 compliance scores, our survey results reveal that the majority of the surveyed large TMT organizations have their senior management's commitment towards IoT security clearly articulated through a formal IoT security policy, adopt proactive risk assessment approaches fueled by IoT vulnerability management, and understand the importance of maintaining their preparedness for facing IoT supply chain risk related events. Then, about the \"Criticality and impact analysis\" control, our survey result reveals that most surveyed large TMT organizations deviate or nearly deviate from the \"as-is\" corresponding IoTSRM2 control. Thus, although most of the surveyed large TMT organizations adopt proactive risk assessment approaches, this survey result suggests that many or at least some of these organizations address IoT risks in most cases using one-size-fits-all IoT security risk management approaches which could have catastrophic consequences. For instance, catastrophic consequences could turn up in the event of a life-threatening IoT risk occurrence while having implemented hugely disproportionate countermeasures across the board to effectively address this IoT risk. With respect to the \"Vulnerability disclosure policy\" control, although the majority of the surveyed large TMT organizations engage in IoT supply chain risk management, our finding shows that most of these organizations contract IoT suppliers that either do not have an up-to-date vulnerability disclosure policy or do not communicate it well enough to them. Moreover, considering that most surveyed large TMT organizations leverage vulnerability disclosures as part of their risk assessment processes, this survey finding further suggests that these organizations establish vulnerability handling processes  
Figure 21: Overall average compliance with IoTSRM2 controls based on the survey responses for large TMT organizations. with their IoT suppliers ahead of contracting. Notwithstanding, the absence of a publicly available vulnerability disclosure policy may translate for these large TMT organizations in not being able to avail of timely IoT patches and in turn having unpatched, blackable IoT technologies in use due to lags in third party IoT vulnerability reporting. Furthermore, with respect to the \"IoT software assets inventory\" control, our survey result shows that the majority of the surveyed large TMT organizations do not have an all-encompassing picture of all their IoT software assets, which further indicates that these organizations may be exposed to shadow IoT software. Moreover, considering that our survey finding shows that some of these organizations are also unaware of all their IoT hardware assets, these large TMT organizations should consider better dealing with inventory their IoT assets to reduce the likelihood of bad thinks happening. It is worth noting that shadow IoT risk may have a cascading effect on the performance of the IoT risk assessment processes if it materializes.