Lynis scan usually takes about 2 mins.

Incubation Inclusion in Release Review: Security Requirements Criteria

Releases typically occur every 6 months.
A release will use the last TSC approved security requirements that were approved at least 6 month prior to the release.
Exceptions must be submitted a minimum of 21 days prior to release
Note: Critical vulnerabilities/security items, as categorized by the Akraino Security Sub-Committee, must be fixed even if found inside lock out window.

Image Added

Maturity Review: Security Requirements Criteria

Exception granted in cases of non-applicability.
Exception granted in cases where another security mechanism mitigates risk.
Exceptions requested for cases above must be approved by the security sub-committee.
Exceptions must be submitted a minimum of 21 days prior to release
The formal email date received, requesting a maturity review would be the Maturity Request date and this would define the set of security requirements that apply.
Note: Critical vulnerabilities/security items, as categorized by the Akraino Security Sub-Committee, must be fixed even if found inside lock out window.

Vuls will be integrated with Blueprint Validation Framework (Bluval User Guide)

...