They must also share results of their risk assessment, or red team, testing with the government.