Risk prioritization ranks vulnerabilities by the risk they pose in a particular environment, rather than by severity score alone. It directs corrective effort toward threats that matter most to the organization. section 6.3.2
Assess each vulnerability in context:
- Check its CVSS severity and whether threat intelligence indicates active targeting. section 6.3.2
- Consider business impact: a production database may deserve attention before an equally severe issue in a low-risk test environment. section 6.3.2
- Account for compensating controls. Segmentation, access controls, and monitoring can reduce immediate risk, while external exposure can increase it. section 6.3.2
- Compare expected risk reduction with remediation effort and cost. section 6.3.2
Figure 6.5 The vulnerabilities in the darker area are the ones that represent the lowest effort/cost vs. the highest risk level. These are the vulnerabilities that should be addressed as a priority.
Use the risk-versus-effort view to identify high-risk vulnerabilities that are relatively inexpensive to address first. section 6.3.2
