Decides which vulnerabilities come first by combining technical severity with business context: asset criticality, exposure, exploitation, patch availability and operational constraints. Each priority is explained. Missing CVSS or exploitation status are never invented: they are reported as limits.
Contents
1. Executive Summary
2. Assessment Scope
3. Prioritization Methodology
4. Prioritization Criteria
5. Overall Vulnerability Overview
6. Prioritized Vulnerability List
7. Critical and Urgent Findings
8. Vulnerabilities Requiring Further Investigation
9. Recommended Immediate Actions
10. Prioritization Limitations
11. Review and Approval
What you provide
Deliverable — You set its title, author and structure.
Assessment — How priorities are decided.
Vulnerabilities — With their asset and operational context.
