I reviewed the diff between -18 and RFC6087. [1]

   [1] https://www.ietf.org/rfcdiff?url1=rfc6087&url2=draft-ietf-netmod-rfc6087bis-18

I assume the security ADs were involved already in discussion about
the new security considerations template in 3.7.1 and the text there
does seem fine to me, so I won't even nit-pick about it:-)

I do have some other nits to note though.

- There are a number of URLs given for access to updated materials
that use http schemed URLs and that do not use https schemed URLs.
There was a recent IESG statement to the effect that those'd be better
as https URLs. The first such example is in 3.1. In fact that URL is
re-directed (for me) to https. I think a general pass to fix such URLs
to use https wherever possible would be easy and better practice.

- Some of the namespaces use http schemed URLs, for example in
section 4.2. I don't know if people are expected to de-reference such
URLs, but if they are then it'd be good to say if https is better to use
or not. (I'd argue it is.) If those URLs are not expected to be 
de-referenced, then saying that would be good. (Not that it'd stop 
people de-referencing 'em so the change is better in any case;-)

Cheers,
S.