; (B) were approved; (C) submitted security vulnerabilities; and (D) received compensation; (2) the number and severity, in accordance with the National Vulnerabilities Database of the National Institute of Standards and Technology, of security vulnerabilities reported as part of such pilot program; (3) the number of previously unidentified security vulnerabilities remediated as a result of such pilot program; (4) the current number of outstanding previously unidentified security vulnerabilities and Department remediation plans; (5) the average length of time between the reporting of security vulnerabilities and remediation of such vulnerabilities; (6) the types of compensation provided under such pilot program; and (7) the lessons learned from such pilot program.