State laws on IoT security: A good start: "California was the first to pass a law mandating better IoT security in 2018 and Oregon has followed suit this year while Illinois, Kentucky, Massachusetts, Maryland, New York, Rhode Island, Vermont and Virginia are considering similar legislation."
https://www.govtech.com/policy/State-Lawmakers-Go-After-IoT-Security-Risks-Contributed.html