There should be government organization currently responsible for data security. Unfortunately, with the proposed leadership options for the White House, I don't think this will be a priority. The FCC is too concerned with rationing out the electromagnetic spectrum. I doubt UL and CE has enough resources to step up here.

For the device makers who want to provide a secure interface to their cloud servers, I think platform and infrastructure providers should set out an easy to adopt standard that any device maker can follow. The expectations on getting a device to market is already so high that small companies typically do not invest in data security.

The incentive to adopt the security best practices could come from retailers. Retailers who only stock products with this standard would save on returns / lawsuits. In the coming year, DDOS attacks are the least of their worries if hackers can commandeer devices that see into people's homes and monitor people's lives.