; (2) the number and severity, in accordance with the National Vulnerabilities Database of the National Institute of Standards and Technology, of security vulnerabilities reported under the pilot program; (3) the number of previously unidentified security vulnerabilities remediated as a result of the pilot program; (4) the current number of outstanding previously unidentified security vulnerabilities and the Department's plans for remediating such vul­ner­a­bil­i­ties; (5) the average period between the reporting of security vulnerabilities and the remediation of such vulnerabilities; (6) the types of compensation provided under the pilot program; and (7) the lessons learned from the pilot program.