2.3.5. Privacy Policy about iot-security-verification-standard-isvs HOT 1 CLOSED

Privacy is an interesting topic that we chose to address with logging and data protection sections. We deliberately opted to exclude policy and process oriented requirements outside of a disclosure policy and threat modeling which security teams may be responsible for (and they're extremely important to IoT security programs). Typically legal teams (or privacy orgs in big companies) would be responsible for defining a data protection / policy rather than security teams. Although important, privacy does not directly correlate to the security of connected products.

from iot-security-verification-standard-isvs.