The expansion of Internet of Things technology and the emergence of a data-driven ecosystem in cyberspace have created new challenges in the fields of regulation, security, and protection of users’ rights. In this context, the Resolution on the Requirements Governing the Internet of Things in the National Information Network, approved in 2018 by the Supreme Council of Cyberspace, is among the earliest policy documents in Iranian law that seeks to organize this emerging technology and manage its risks. However, it has rarely been independently analyzed from the perspective of criminal policy. The main issue addressed in this study is what orientations this Resolution adopts from the standpoint of criminal policy and to what extent it can respond to the legal and criminal-law requirements of the complex Internet of Things ecosystem. Accordingly, the purpose of the present article is to explain the components of criminal policy reflected in the Resolution, identify its preventive and regulatory approaches in confronting IoT-related risks, and clarify the existing gaps and ambiguities in the Resolution. The present research is theoretical in nature and employs a descriptive-analytical method. The data were collected through library research and content analysis of the text of the Resolution and related sources. The findings indicate that the Resolution reflects a preventive, regulatory, and sovereignty-oriented approach to criminal policy, emphasizing the ex ante control of risks, the registration and identifiability of ecosystem elements, authentication, security provision, and the possibility of exercising sovereignty in the Internet of Things environment. Nevertheless, at the level of implementation and legal response, the Resolution faces fundamental gaps and, from the perspective of criminal policy, has not yet reached the level of a comprehensive, transparent, and effective framework. Enhancing the effectiveness of this Resolution requires legislative and executive supplementation through the design of operational mechanisms for incident reporting, preservation and maintenance of digital evidence, and the establishment of specific mechanisms for international judicial or executive cooperation in dealing with crimes related to the Internet of Things.