d. Are procedures in place to handle when vulnerabilities are publicly disclosed without notifying the
developer or giving sufficient time to produce a patch)?
e. Is there a sufficiently comprehensive set of information sources that are monitored for reported
vulnerabilities in your own software, in third-party products, and competitor/analogous products?