Guidance:
You might want to consider:
How IoT security is the different to traditional computing
How IoT security is the same as for traditional computing
What data IoT devices need / have
Changing user behaviours
How IoT devices communicate
IoT user experience (how users interact with devices)
Device manufacturer motivation (priority of security)
How they might be attacked
Attack motivation and types (CIA)
Risk & response