## 3 Results
### Results for Surveyed Large and Small-Medium Organizations
#### 3.1.2 Results for Part II of Our IoTSRM2 Survey
This finding reveals that most surveyed organizations underperform when it comes to managing IoT supply chain risk which may increase the likelihood of IoT supply chain risk occurrence given that IoT adoption amplifies the interdependencies between the surveyed organizations and their supply chains. This is because they tend to manage their relationships with their IoT suppliers in an ad hoc fashion rather than relying on structured IoT supply chain risk assessments and trustworthiness requirements underpinned by clearly defined IoT supply chain risk management and IoT supplier contract management plans. As for the \"Governance\" domain, the majority of the survey responses are \"Yes, to a certain extent\" and \"Yes, to a great extent\" for the \"IoT security policy\", \"Privacy policy\", \"IoT security operations roles and responsibilities\", \"IoT security governance structures and responsibilities\", \"Cybersecurity regulatory framework\", and \"IoT vulnerability management plan\" controls and related questions, whereas the majority of the survey responses are \"No, to a great extent\" and \"No, to a certain extent\" for the \"Vulnerability disclosure policy\", \"End-of-Life policy\", \"IoT security and privacy controls management plan\", \"IoT security budget plan\", \"IoT security measurement and reporting plan\", \"IoT security training and awareness plan\", \"IoT security incident response plan\", and \"IoT End-of-Life plan\" controls and related questions. This finding suggests that although most surveyed organizations have IoT security and privacy policies, understand their compliance obligations, and have IoT security governance structures and responsibilities in place, they underperform in strategizing governance and risk management for their IoT infrastructures (i.e., except for vulnerability management) and fail in ensuring that their IoT suppliers have clearly documented vulnerability disclosure and End-of-Life policies in place. Hence, considering that the majority of the surveyed organizations may rely on a relatively fragile base for crafting their IoT security risk management strategy, this finding is quite worrying for these organizations as it may have cascading consequences on the execution of their IoT security risk management strategy. In this context, the majority of the surveyed organizations should consider reviewing and improving their controls related to the IoTSRM2 controls of the \"Asset Management\", \"Risk Management Strategy\", \"Supply Chain Risk Management\", and \"Governance\" domains. **Weighted Results on IoTSRM2 Controls for Surveyed Organizations**  
Second, Section 3.1.2 outlines the key results on the IoTSRM2 controls for the surveyed organizations by outlining the overall average compliance with IoTSRM2 controls. The overall average IoTSRM2 compliance score for each IoTSRM2 control and related question resulted based on all survey responses and the corresponding IoTSRM2 adjusted control weight for that IoTSRM2 control and related question. It is worth noting that, for each IoTSRM2 control, the overall average IoTSRM2 compliance score is calculated using Equations (1)-(3) (see Section 2.2.3). Furthermore, Figure 13 presents the consolidated view of the survey responses through the corresponding overall average IoTSRM2 compliance score for each IoTSRM2 control and related question. For each IoTSRM2 control and related question, this figure indicates whether the corresponding overall average IoTSRM2 compliance score leans towards deviating from or meeting the \"as-is\" IoTSRM2 control. Figure 13 shows that the overall average IoTSRM2 compliance score across the survey respondents' organizations or client organizations (i.e., the surveyed organizations) is less than 50% for the majority of the IoTSRM2 controls and only marginally greater than 50% for the remaining eleven IoTSRM2 controls.