Which of the following is a fundamental principle of cve assessment & patch management as it applies to Certified Cybersecurity Professional?