Answer: Require encrypted comms (TLS or secure radio), password/role management, firmware update controls, vulnerability disclosure process, and a requirement for vendors to provide signed firmware and a patching policy. Include an acceptance test for security hardening during commissioning.