An organizational policy requires critical security patches to be deployed in production within three weeks of patch availability. Which of the following is the BEST metric to verify adherence to the

The policy sets a maximum allowable deployment time of three weeks. By tracking the maximum time gap, an organization can identify any single instance where the policy was violated, ensuring that the critical deadline for all patches is met, not just a percentage.

Percentage of critical patches deployed within three weeks could mask individual failures; if 99% are deployed within time, but one critical patch takes four weeks, the policy is still violated for that specific patch.

The minimum time gap is irrelevant to verifying adherence to a maximum deployment timeframe.

The number of critical patches deployed within three weeks doesn't indicate if all relevant patches met the three-week deadline or if any individual patch exceeded it.