Typically I hate this kind of blog. More often than not, they get it wrong and tend to oversimplify. This post on the whole is good though. However: This guy

Typically I hate this kind of blog. More often than not, they get it wrong and tend to oversimplify. This post on the whole is good though. However: This guy is a security guy? Why is he dealing in absolutes? The law is a step forward. It's perfectly reasonable to get something on the books, even if it's far from perfect. It's a rough (very rough) draft of GDPR-like principles applied to security. Being "reasonable and appropriate" is a perfectly reasonable requirement. You will demonstrate it by having evidence of a security-focused (as opposed to product-focused) assessment before you launched your shitty IoT product. That "reasonable and appropriate" is vague is a good thing, not a bad thing. It floats with the current set of threat vectors.