These are pretty good, but one problem for 'general' adoption of something like this:

Most customer orgs aren't qualified to judge the vendors answers because they aren't good at security either.

Are you confident you know what a good answer to 'how do you push code to production' looks like?