Do you have remediation targets (SLAs) set for vulnerabilities and pen-test findings? If so, please describe.

The high and medium Pen-test findings are fixed within 2 weeks of the report. Each finding is created as an issue or requirement within JIRA. Vulnerabilities scans are performed at the beginning of the month, the remediation to the vulnerabilities is first applied to DEV/Staging in the 2nd week of the month and then to production on the fourth Saturday of the month