The industry now has official guidance on design, materials, and more, but not security and privacy best practices.