Could be worth them looking at the Trusted Technology Mark which has been doing the hard work of figuring out how to certify connected devices:

https://web.archive.org/web/20190212185530/https://trustable... (edit: linking via archive.org as the site appears to be redirecting at least some clicks to scam sites)

The axes are interesting and a good starting point. From their site:

* Privacy & Data Practices: Is it designed using state of the art data practices, and respectful of user rights?

* Transparency: Is it made clear to users what the device does and how data might be used?

* Security: Is it designed and built using state of the art security practices and safeguards?

* Stability: How robust is the device and how long of a life cycle can a consumer reasonably expect?

* Openness: How open are both the device and the manufacturer‘s processes? Is open data used or generated?