The IoT Cybersecurity Improvement Act would NIST to best practices for device security. The Office of Management and Budget would create guidance for agencies to meet or exceed those standards.