Which three of the following security controls would you take into consideration when implementing IoT capabilities?

A layered security approach (defense in depth) is a core IoT principle that combines network segmentation, encryption, authentication, and physical controls to reduce attack surface across multiple tiers of an IoT deployment.

Placing security above functionality is not an accepted IoT design principle; the standard is security by design that balances both, since overly restrictive controls can render resource-constrained IoT devices non-operational.

Defining lifecycle controls ensures security is enforced from provisioning through patching to decommissioning, directly addressing the long operational lifetimes and infrequent update cycles that make IoT devices high-risk targets.

A Privacy Impact Assessment is mandatory for IoT because these devices continuously collect and transmit environmental and user data, requiring formal evaluation of data flows, storage, and third-party sharing before deployment.

Frequent password rotation is a general IT policy that does not apply well to IoT, where many devices use embedded or shared credentials and lack interfaces or firmware support for regular password changes.

IoT devices are resource-constrained and cannot host IDS agents locally; intrusion detection for IoT is implemented at the network perimeter or gateway level, not on the devices themselves.