what must be developed?

In order to show improvement of security over time, what must be developed?

A.
Reports

B.
Testing tools

C.
Metrics

D.
Taxonomy of vulnerabilities