## 4 Related Work
Thus, first, Palo Alto Networks [15] provided merely some details about their experimental setup and data gathering rather than describing the analysis and reporting activities of the data collected from their customers. Second, [PERSON] and [PERSON] [31] developed the questionnaire used for running the survey and provided details on how their questionnaire was developed. However, [PERSON] and [PERSON] [31] provided limited details on how the survey planning and creation were performed and did not clearly outline the ways in which the analysis and reporting of survey responses were carried out. Third, Arm Limited [32] provided limited details about their methodology including the use of the Sapio Research online panel for conducting the survey, the usage of email invitations, and the distribution channels used for requesting survey participation. In this context, the methodology provided by Arm Limited [32] does not outline how the questionnaire is developed, how the survey is designed, and how the analysis and reporting of survey responses are performed. Fourth, [PERSON] and [PERSON] [33] described the methodology for their interview-based study only half-way as it provides details about the type of questions used, the design of the questionnaire, the selection of the respondents, and the reporting format (i.e., through quotes) without describing the data collection and analysis activities. Finally, the Cabinet Office [34] provided limited details on their methodology and reported the use of the Ipsos MORI online panel for running their survey, the incentive used for attracting more survey participants, and the details concerning the request for survey participation. However, the Cabinet Office [34] did not provide details on how the questionnaire was developed, how the survey was designed, and how the analysis and reporting of survey responses were performed. **E3: The underlying design best practice of the research method of the methodology is clearly documented**  
As per Table 10, none of the 12 reviewed related works clearly documented the design best practice on which the research method of their methodology is based. However, [PERSON] and [PERSON] [33] documented their own principles guiding the questionnaire design for their interview-based study, which are not based on a well renowned reference source. Compared with the 12 reviewed related works, our IoTSRM2-based survey study relies on the principles for designing web questionnaires developed by [PERSON] et al. [20], and the applicability of these principles to our IoTSRM2-based survey is clearly documented as part of Table 5.  
**E4: Provides results for organizations of a specific organization size**  
Our IoTSRM2-based survey study reports the percentage distribution of the surveyed organizations by organization category/type (i.e., based on the organization size) (see Section 3.1.1), the IoTSRM2 compliance score of each of the surveyed organizations together with indicating the category/type (i.e., based on size) of that organization (see Section 3.1.2), and the IoTSRM2-based survey results on the surveyed large organizations (see Section 3.2). In addition, from the 12 reviewed related works, three of them provided results for organizations of a specific organization size (i.e., [32; 36; 39]), whereas the remaining ones did not provide any results for organizations of a specific organization size (i.e., [15; 33; 34; 35; 37; 38; 40]). Regarding the three reviewed related works that provided results for organizations of a specific organization size, Arm Limited [32] provided some of their results for small organizations and for large organizations (e.g., threat modelling adoption, satisfaction with IoT security expertise), Gemalto [36] provided all their results for large organizations having an employee headcount of more than 250, and the SANS Institute [39] provided some of their results by organization size (e.g., number of connected IoT devices).