A.If the findings impact regulatory compliance, remediate the high findings as quickly as possible.

B.If the findings impact regulatory compliance, try to apply remediation that will address the most findings for the least cost.

C.If the findings do not impact regulatory compliance, remediate only the high and medium risk findings.

D.If the findings do not impact regulatory compliance, review current security controls.