Focus on elements such as:Who is responsible for requesting something be remediatedWho is responsible for determining the scope of the request and its priority/severityWhat testing has to be done, and who must approve it in order to push something to the environmentHow do you track status through each of these items including time taken, roadblocks, etc.How much did it cost to fix each vulnerabili