Measurement and communication of how many of the vulnerabilities handling per severity for components like applications are aligned to SLAs. This is performed for the hole organization and doesn't need to be broken down (yet) on team/product/application. At least quarterly.