Revise processes for products considered to be vulnerability assessments to (a) update them every 2 years or document the determination why an update was not needed, and (b) regularly assess and update the status of efforts to mitigate vulnerabilities and to address previous recommendations.