CySA+ - Reporting and Communication - Vulnerability management metrics