Building and maintaining a risk register in Openlane
Running a vulnerability scanning program that stands up to an audit