Your employees may want to connect their own consumer IoT devices to your networks, bring RF devices into your physical spaces, or need to interact and/or use your business IoT systems. No matter their intention, security training for employees should at a minimum: 

• Describe what types of devices can and cannot be connected to your networks
• Describe what types of devices are not allowed in company locations
• Describe any permissions a person must receive prior to using IoT devices in company locations
• Describe any types of restricted areas where IoT devices are not allowed
• Describe the privacy concerns that come with some IoT devices and ensure that employees understand their responsibility to safeguard privacy

Employees that interact with business IoT systems must also be trained on: 

• The risks associated with using IoT devices
• The proper methods for operating IoT devices and systems
• Safety concerns and requirements for operating IoT systems
• Privacy concerns and requirements for operating IoT systems
• Proper methods for disposing of IoT assets
• Requirements for safeguarding the confidentiality of data within an IoT system
• What to do when an IoT system becomes unavailable