86 percent (6 out of 7) of the sampled information systems had critical vulnerabilities not remediated within 30 days, as required.