There are several propoals to look at, many of which claim to "collect information from security controls and perform analysis based on pre-established metrics." What capability are these vendors referring to?