A county risk register wants to import scanner base scores unchanged for every civic asset. What caution should guide severity mapping?
Select an answer to reveal the explanation.
Short Explanation
A medium on a forgotten printer is not the same medium on the payment portal. Take the scanner number, then weigh who can reach it and what it protects.
Full Explanation
CVSS base scores describe intrinsic characteristics of a vulnerability, not the county's specific exposure or mission impact. Environmental factors—internet reachability, data sensitivity, compensating controls—must adjust priority. Blind import of base scores misorders the risk register.