## 1 Introduction
Hence, on top of the existing cybersecurity-related laws and regulations [16], government and regulatory bodies from around the world work on introducing new laws to increase IoT security. For instance, the U.S. Congress [17] enacted the federal IoT Cybersecurity Improvement Act of 2020, which aims to \"establish minimum security standards for Internet of Things devices owned or controlled by the Federal Government, and for other purposes\", and the UK's Department for Digital, Culture, Media & Sport [18] plans to introduce new laws that regulate the security of consumer IoT devices. Moreover, in response to the IoT security issues and risk, domestic and international standards bodies and industry associations have developed various IoT security codes of practice, standards, guidelines, and frameworks [14]. However, given the absence of a global baseline IoT security standard [11], the issue that the existing IoT security best practices are primarily focused on the more technical aspects [3], and the acute need for better IoT security risk management in organizations [19], the IoT security risk management strategies of industry and government organizations embracing IoT technologies tend to be more fragile than robust [14]. This prevalent absence of robust IoT security risk management strategies in organizations together with the paucity of IoT security risk management reference sources were highlighted in our previous article [14], which revealed the absence of an IoT security risk management strategy reference model. This research problem was addressed by proposing a novel IoT security risk management strategy reference model (IoTSRM2) to support IoT security practitioners from industries and governments to frame or rethink their IoT security risk management strategies [14]. Thus, this article extends on our previous research work [14] and focuses on addressing the proposed future work, namely the undertaking of an IoTSRM2-based survey to determine the current state of IoT security risk management strategies in surveyed organizations relative to our IoTSRM2. Moreover, considering that, at the time of writing, there is no research study found to exclusively focus on determining the current state of IoT security risk management strategies in surveyed organizations, there is a clear research gap in terms of the existence of such a research study. Thus, the purpose of this research article is to undertake an IoTSRM2-based survey to determine the current state of IoT security risk management strategies in the surveyed organizations relative to the IoTSRM2 considering the views of leaders from industries and governments from around the world. Moreover, this research article aims to support IoT security practitioners from industries and governments to establish the current state of their IoT security risk management strategies when benchmarked against their peers and in turn to enable them to enhance these strategies for matching or outrunning the IoT security risk management strategies of their peers. Hence, in response to the research gap and the purpose mentioned above, the research questions of this research study are the following:  
* **RQ1:** What is the overall tendency of the IoT security risk management strategies of the surveyed organizations to meet or deviate from the IoTSRM2 controls? * **RQ2:** What is the IoTSRM2 compliance score of each of the surveyed organizations? * **RQ3:** Which is the top organization type for the surveyed organizations by survey respondents? * **RQ4.a:** Which is the top industry sector for the surveyed organizations by survey respondents? * **RQ4.b:** Which is the top industry sector for the surveyed organizations of the top organization type by survey respondents? * **RQ5.a:** What is the overall average IoTSRM2 compliance score of the surveyed organizations for each IoTSRM2 control? * **RQ5.b:** What is the overall average IoTSRM2 compliance score of the surveyed organizations of the top organization type for each IoTSRM2 control?