NIST SP 800-218A RV.1.3: Vulnerability disclosure and remediation policy covers AI models and informs users of limitations (Medium)

What does RV.1.3 require?

The organisation's vulnerability disclosure and remediation policy, with its roles, responsibilities and processes, includes AI model vulnerabilities, and users of the models are made aware of the models' inherent limitations and of how to report any cyber security problems they meet.

Maintained by Gerard Blokdyk

Other controls in Respond to Vulnerabilities (RV) – NIST SP 800-218A

RV.1.1 Gather vulnerability information, including from model input and output monitoring and AI vulnerability databases (High)
RV.1.2 Frequent, largely automated scanning and testing of models, with periodic audits (Medium)
RV.2.1 Analyse each vulnerability, including deep analysis of model input and output deviations (Medium)
RV.2.2 Risk responses that allow for rebuild cost and for stopping or rolling back a model (High)
RV.3.1 Root cause analysis supported by after-the-fact review of training and alignment data (Medium)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All NIST SP 800-218A controls