b48f56c1__Application_Firewalls___OWASP__Comment
[Criterion] Error rectification times by the manufacturer are short. The response times from the manufacturer from the reporting of an error to delivery of a patch are less than a week for critical errors. Theses can either be error rectification times based on contracts or empirical error rectification times, e.g. for open source products. [Points] 3 [Comment] 
Important, but only helps to a limited extent.
Category:OWASP Best Practices: Use of Web Application Firewalls - OWASP