## 1 Introduction
* **RQ5.c:** What is the overall average IoTSRM2 compliance score of the surveyed organizations from the top industry sector of the top organization type for each IoTSRM2 control? * **RQ6.a:** Which is the top position level of the survey respondents for the surveyed organizations by survey respondents? * **RQ6.b:** Which is the top position level of the survey respondents for the surveyed organizations of the top organization type by survey respondents? * **RQ6.c:** Which is the top position level of the survey respondents for the surveyed organizations from the top industry sector of the top organization type by survey respondents? * **RQ7.a:** Which is the top region for the surveyed organizations by survey respondents? * **RQ7.b:** Which is the top region for the surveyed organizations of the top organization type by survey respondents? * **RQ7.c:** Which is the top region for the surveyed organizations from the top industry sector of the top organization type by survey respondents? To address the research questions above and achieve the intended outcome of this research study, this article relies on a mixed methods research methodology harnessing both qualitative and quantitative methods. Thus, our research work makes use of quantitative data to complement the qualitative data, which adds value to the outputs of this research and allows the reporting of the IoTSRM2 compliance results. In this context, the outputs of this research work concretize into the main contributions outlined below:  
* The design of a methodology for determining the current state of IoT security risk management strategies in the surveyed organizations relative to the IoTSRM2;
* The determination of the current state of IoT security risk management strategies in the surveyed organizations relative to the IoTSRM2 by analyzing the survey responses and reporting our IoTSRM2-based survey results;
* A comparative analysis of the related work for this IoTSRM2-based survey study based on a set of evaluation criteria. Beyond this introductory section, the remainder of this article is organized as depicted in Figure 1. Section 2 provides an overview of the IoTSRM2 and describes the three-phased methodology for addressing the research questions of this study and in turn for determining the current state of IoT security risk management strategies in the surveyed organizations relative to the IoTSRM2. Section 3 presents our IoTSRM2-based survey results. Then, Section 4 presents the related work. Finally, Section 5 presents the concluding remarks and future work. Then, Figure 2 provides a reading map for our research questions. This mapping should be leveraged in conjunction with the 14 research questions and Figure 1 by readers interested in specific research questions of our study, where:  
* \"Mapping 1\" and \"Mapping 2\" correspond to the results sections related to the surveyed large and small-medium organizations;
* \"Mapping 3\", \"Mapping 4\", and \"Mapping 5\" correspond to the results sections related to the surveyed large organizations, where \"Mapping 5\" corresponds to the surveyed large organizations that operate in the \"Technology, Media, & Telecom (TMT)\" industry sector in particular. Figure 1: The structure of this article. For instance, assuming a reader is interested in RQ3, Figure 2 guides the reader via \"Mapping 1\" to read Sections 1, 2, 3.1.1, 4 and 5. Furthermore, our mapping for possible items of interest from this article is provided in Appendix A as part of Table A1 which includes 25 selected items considered of interest and their corresponding sections, modes of presentation, main justification for inclusion, and indicative links.