What is a vulnerability management metric?

In a SOC environment, what is a vulnerability management metric?
A. code signing enforcement
B. full assets scan
C. internet exposed devices
D. single factor authentication