Here's a few things that I would find useful for IoT device labeling: 1) An indication of whether it supports local control, or requires an internet connection

Here's a few things that I would find useful for IoT device labeling: 1) An indication of whether it supports local control, or requires an internet connection. (I can control my Philips Hue lights from my phone even when the internet is down, as long as they're on the same network. However, my MyQ Garage Door opener can only be controlled from my phone when both the phone and the garage door have an internet connection.) The reason this relates to security is that devices supporting local control can be completely firewalled, significantly reducing the attack surface. 2) A commitment of how long the device will receive updates. It should probably be in the form of an end date, or a number of years from the date of purchase, because "5 years of support" currently often means "5 years from when the product was first sold, which was 4 years ago, so you really only get 1 year of support if you buy today". Separate dates for features and security fixes would be acceptable. There should probably be some provision for vendors to extend this, since they would generally want to for devices that sell better. They should just be prevented from shortening it without penalties (e.g. a full refund offered to all purchasers.) 3) A clear indication of what happens after the above date passes - does the device continue working? become completely inoperable? loose some features? etc. 4) Some indication of openness, ideally in a way that encourages it. Maybe an "A+" rating requires that the vendor make available everything needed to compile and install a new firmware. Some differentiation could be made between devices that are open at the time of purchase and devices where the vendor has made a commitment to open it up after the support period ends.