Which of the following BEST indicates an effective vulnerability management program?