Through reading whitepaper you will notice if the ICO is legitimate and they are on track based on the timeframe or roadmap. Also, you need to know the team structure and/or they willing to communicate regarding the consistent information about the project. There are many ways to know the ICO legitimacy. It depends on you how applies. In my suggestion to get consistent and accurate information about the ICO. Conduct own research and study about it before you engage.