This sixth GTAG was developed to help chief audit executives pose the correct questions to their IT security staff when assessing their vulnerability management processes. The guide recommends specific management practices to help achieve and sustain higher levels of effectiveness and efficiency and illustrates the differences between high- and low-performing vulnerability management efforts.