The best way to minimize intellectual property theft and sensitive information loss in IoT acquisitions is to integrate supply chain cyber risk management processes. This holistic approachincludes assessing supplier security posture, monitoring for threats, and ensuring cybersecurity is embedded into procurement, delivery, and operations.

NDAs, sanctions, and data classification are supportive, but only supply chain risk management addresses the full lifecycle risks and modern threats in globally sourced IoT ecosystems.

CGEIT Review Manual: Domain 4 -- Risk Optimization

COBIT 2019: DSS05 (Manage Security Services), APO10 (Manage Suppliers).