A policy defining requirements for identifying, assessing, remediating, and reporting security vulnerabilities.