Description should include
prioritizing remediation by identifying hosts that are directly exposed to untrusted networks
determining the actions that would provide the greatest impact to improving security.