NIST SP 800-218A RV.1.1: Gather vulnerability information, including from model input and output monitoring and AI vulnerability databases (High)

What does RV.1.1 require?

In gathering vulnerability information from acquirers, users and public sources and investigating credible reports, the organisation logs, monitors and analyses all model inputs and outputs for possible security and performance issues; makes the users of its models (AI system producers and acquirers) aware of how to report potential security and performance issues; and monitors vulnerability and incident databases for AI-related concerns, including those affecting the ML frameworks and libraries its models are built with.