When procuring IoT devices, the firmware update mechanism should be evaluated; ideally, devices should support automatic or semi-automatic firmware upgrades and have signature verification capabilities.