Are security vulnerabilities monitored?

Yes. The reviewed materials state that Nessus vulnerability scans occur every 14 days and that third-party penetration testing is performed annually.