Two CVEs have similar base CVSS scores: one affects the city's public permitting site and one affects an offline label printer in a locked basement. How should the vulnerability team prioritize remediation?

Prioritization must blend base CVSS with environmental exposure and municipal business impact. Similar numeric scores do not imply identical urgency: an internet-facing permitting-site CVE is reachable by anyone on the public Internet and can disrupt a core citizen workflow, while an offline basement label printer behind locked doors presents far less immediate attack surface and mission consequence. Weighting those factors correctly puts the permitting remediation ahead without pretending the printer risk is zero forever.

Always patching the printer first because “physical devices are inherently higher risk” ignores exposure and impact and can delay the public-facing fix. Ignoring CVSS entirely and patching only never-scanned systems abandons a useful severity signal and leaves known scored issues unaddressed. Assigning identical deadlines solely because base scores match treats unequal environments as equal and wastes limited change capacity on the wrong order.

Exam caveat: CVSS base scores are starting points; temporal and environmental modifiers, asset criticality, and threat intel about active exploitation further adjust SLAs. CompTIA expects contextual prioritization, not score-blind or score-only queues.

Operational check: tag internet-facing citizen services in the CMDB, apply exposure multipliers in the vuln platform, set shorter SLAs for public permitting CVEs, and schedule the printer into a lower-priority maintenance window with compensating physical controls noted.