# Analysis of Enterprise Internet of Things Maturity Models: A Review
## 5 Results and Analysis
### 1 How Are Internal Measurement Processes Performed Within the Proposed  
Maturity Models? The internal measurement processes of maturity models are the methods and techniques used to assess an organization or system's current state and progress regarding its IoT maturity level, which varies depending on the maturity model's domain, purpose, and design [53]. The available literature reveals a diverse view of the internal measurement processes within the proposed maturity models. First, a common trend in several articles is the need for explicit details on these processes, where the main focus revolves around the qualitative analysis of the overall maturity levels, leaving the internal measurement processes needing to be addressed [42]. This suggests a predominant gap in the literature, where the emphasis falls more on results and assessments than on the complex methodologies employed in internal measurements. Nevertheless, some common elements among the different maturity models proposed in the scientific corpus can be identified. In this regard, different approaches have been proposed and applied to perform internal measurement processes within maturity models in various domains and disciplines, such as digital finance [38], security and vulnerability management [54], smart objects [44], forensics [49], digital engineering, security, and IoT adoption [55]. These approaches vary in terms of methods, tools, data sources, indicators, metrics, scales, and criteria used to measure the maturity level of an organization or system. In addition, some maturity models employ more qualitative methods such as interviews, focus groups, observations, and document analysis to assess maturity [13; 56]. The collected qualitative data are coded and analyzed to identify patterns related to the organization's maturity levels of IoT-related practices, processes, and technologies. The maturity models consulted in the literature have several standard processes that establish IoT technology maturity. Starting with the data collection process, gather information from various sources, such as surveys, interviews, observations, documents, or data analysis, to assess the organization's or system's current situation regarding the maturity model [56]. Data collection methods should be reliable, valid, and consistent and cover all relevant aspects of the model. Some of the most used sources for these measurement mechanisms are the organization's employees [56], stakeholders, manufacturers, vendors, third-party reports [57], literature reviews, and expert panels [52], providing opinions, perceptions, comments, information, and empirical evidence on the current and desired state of the organization regarding IoT to the maturity model. Specifically, the most used element for data collection is questionnaires that usually consist of questions related to the maturity model's dimensions, sub-dimensions, indicators, or criteria. They ask respondents to rate their organization or system according to a predefined scale. Also, questionnaires are completed by self-assessors or consultants after analyzing practices, conducting interviews with stakeholders, and collecting data [41; 52]. A second standard process in the proposed maturity models is data analysis, in which the collected data are interpreted and summarized using statistical or mathematical methods; these should be appropriate, rigorous, and transparent and provide meaningful and actionable results as inputs for subsequent phases [49]. Some of the standard methodsused to perform internal measurement processes within maturity models are principal component analysis (PCA) [42], cluster analysis [58], as well as more straightforward techniques such as fuzzy assessment [59], word frequency analysis, maturity matrix, score calculation, scoring systems, capability level mapping, and benchmarking [60]. These methods can be used to reduce the dimensionality of the data, extract essential elements, divide entities into different groups, and assign them to different maturity levels, among others [25; 42].