NIST AI 600-1 suggested actions for generative AI on a defense program

The companion page NIST AI 600-1 (Generative AI Profile) for defense contractors is what the profile is. This page is what a subset of its suggested actions actually say when a defense program is buying or deploying generative AI. The profile remains intended for voluntary use. We found no 32 CFR Part 170 or DFARS clause that incorporates it.

NIST published the Generative Artificial Intelligence Profile on 26 July 2024. The PDF is NIST AI 600-1. Official pages still say Generative AI and GAI. This article uses those names. Where this site speaks in its own voice about current U.S. executive-branch policy it uses Super Intelligence (SI); that voice does not rewrite the NIST title.

Actions that name acquisition and contractors

The profile says cross-sectoral profiles can cover activities or business processes common across sectors, such as the use of large language models (LLMs), cloud-based services, or acquisition. Suggested actions that name buyers, vendors or contractor personnel include:

• GV-6.1-009. Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy, security, and other risks. The same action tells organizations to assess GAI vendors, open-source or proprietary GAI tools, or GAI service providers against incident or vulnerability databases.
• GV-6.1-010. Update GAI acceptable use policies to address proprietary and open-source GAI technologies and data, and contractors, consultants, and other third-party personnel.
• GV-6.1-006. Include clauses in contracts which allow an organization to evaluate third-party GAI processes and standards.
• GV-6.1-007. Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.

Those sentences are NIST suggested actions. They are not a DoD contract clause. See the NIST AI RMF explainer.

Actions that name national security and information security

GV-2.1-004 says: When systems may raise national security risks, involve national security professionals in mapping, measuring, and managing those risks. The profile attaches that action to CBRN information or capabilities, dangerous content, and information security. It is not a classified-system overlay.

Section 2.9 of NIST AI 600-1 states the information-security problem the profile is trying to manage: GAI-based systems present two primary information security risks: GAI could potentially discover or enable new cybersecurity risks by lowering the barriers for or easing automated exercise of offensive capabilities; simultaneously, it expands the available attack surface, as GAI itself is vulnerable to attacks like prompt injection or data poisoning.

GV-6.2-003 tells organizations to establish incident response plans for third-party GAI technologies, including communicating those plans, defining ownership, rehearsing them, and reviewing them against relevant breach reporting, data protection, data privacy, or other laws.

Retrieval, fine-tuning and third-party models

MG-3.1-001 tells organizations to apply organizational risk tolerances and controls (e.g., acquisition and procurement processes; assessing personnel credentials and qualifications, performing background checks; filtering GAI input and outputs, grounding, fine tuning, retrieval-augmented generation) to third-party GAI resources. MG-3.1-003 adds: Re-assess model risks after fine-tuning or retrieval-augmented generation implementation and for any third-party GAI models deployed for applications and/or use cases that were not evaluated in initial testing. MG-3.1-005 says to review various transparency artifacts (e.g., system cards and model cards) for third-party models.

Those are the sourced reasons a retrieval or fine-tune on a defense program is in the profile’s suggested-action tables. They still sit under Govern, Map, Measure and Manage in the AI RMF Core.

What these actions do not do

• They do not assign a CMMC Program level. CUI scoping stays on CMMC and AI with CUI and CMMC Program scoping for generative systems that handle CUI.
• They do not replace DoD Responsible AI. CDAO says the RAI Toolkit is built upon the NIST AI Risk Management Framework and Toolkit, among other sources. That sentence names the AI RMF, not AI 600-1.
• They are suggested actions. The profile says implementation of the suggested actions will vary depending on the type of risk, characteristics of GAI systems, stage of the GAI lifecycle, and relevant AI actors involved.

Analysis, not sourced fact: a workable contractor reading is to take the acquisition, acceptable-use, national-security and incident-response actions as a vendor-and-prompt hygiene list, then keep CUI and FedRAMP questions on the CMMC pages. Do not treat the profile as a substitute System Security Plan.

Questions

Does completing these suggested actions satisfy CMMC?

No source we cite says that. 32 CFR Part 170 is a cybersecurity assessment program for FCI and CUI. AI 600-1 is a voluntary generative-AI profile of the AI RMF.

Is GV-2.1-004 a classified-work requirement?

The sourced sentence is to involve national security professionals when systems may raise national security risks. It is not a classification guide.

Where do I start if the program already uses the RAI Toolkit?

Keep the AIA Toolkit listing for DoD ethical-principle evidence. Read the 600-1 actions above for generative-specific acquisition, acceptable-use and information-security prompts the toolkit page does not reprint. For suggested actions on the AI RMF Core itself (not the generative profile), see the NIST AI RMF Playbook; that page says suggestions are voluntary and that the Playbook will be updated after AI RMF 1.0 is revised.