Business impact analysis brings operational context into vulnerability prioritization. A severity score alone does not show how much a vulnerable system matters to the organization. Consider the potential effect on business operations before deciding what to correct first. section 6.3.2
Same severity, different priority
An equally severe vulnerability may deserve faster attention in a mission-critical production database than in a low-risk test environment. Weigh that impact alongside exploit likelihood, threat intelligence, and compensating controls. The aim is to direct corrective effort toward the greatest risk reduction, rather than treating every high severity score alike. section 6.3.2
