Which of the following is the BEST metric to demonstrate the effectiveness of an organization's patch management process?

Average time to implement patches is a good metric, but 'percent implemented within established timeframe' is more comprehensive as it considers the target goal for *all* patches.

The number of patches tested is a measure of a step in the process, not the overall effectiveness of the entire management process in reducing vulnerability exposure.

An increase in deployment frequency doesn't necessarily indicate effectiveness; it could mean more vulnerabilities or just a higher volume of patches without addressing timeliness or coverage.

This metric directly quantifies the organization's ability to meet its patching objectives and security policies, showing how consistently patches are applied within acceptable windows. It reflects both the speed and completeness of the patching process relative to established goals.