For the protection of customer data, Requirement 5 of PCI-DSS requires that the organization maintain a vulnerability management program through?