Actions described in security standards (like ISO 27002, PCI-DSS, HIPAA, Common Criteria) greatly vary according to the domain data that they store, process, transmit and report.
We have a product which collects metrics from a network/wifi enabled luminaries (lighting device) and make analytics data for trend analysis or energy efficiency calculations. What is the minimal security standard that the product needs to meet? It has a device discovery module, data aggregation and a reporting web-app hosted in the cloud and the data moves from enterprise to cloud platform.
I am thinking of at least OWASP 10 but then its not standard rather guidelines of security controls for web-application.