Version 3 acknowledges that capability evaluations are ambiguous and that security above the RAND SL3 level needs government help, and it moves from threshold-triggered rules toward continuous risk reporting. The first Risk Report under the new policy followed in August, after the summer incidents.
What to do: use the roadmap's graded goals and the Risk Reports as the reference for vendor questions about alignment, security and safeguards.
