Decides which vulnerabilities come first by combining technical severity with business context: asset criticality, exposure, exploitation, patch availability and operational constraints. Each priority is explained. Missing CVSS or exploitation status are never invented: they are reported as limits.
Contents
1. Executive Summary
2. Assessment Scope
3. Prioritization Methodology
4. Prioritization Criteria
5. Overall Vulnerability Overview
6. Prioritized Vulnerability List
7. Critical and Urgent Findings
8. Vulnerabilities Requiring Further Investigation
9. Recommended Immediate Actions
10. Prioritization Limitations
11. Review and Approval
What you provide
Deliverable — Its title, its author and its structure are yours: they steer what is written.
Assessment — How priorities are decided.
Vulnerabilities — With their asset and operational context.
