1. What is the first step you should do before starting to actively perform a vulnerability assessment?

2. What step follows Remediation? Why must it be performed?

3. You see mitre.org in most of the security database sites. MITRE is not a private corporation. They are an federally-funded research and development corporation (FFRDC) like ORNL. Look at the page https://www.mitre.org/centers/national-cybersecurity-ffrdc/who-we-are and answer which Center of Excellence they manage.