When classifying and prioritizing risk responses, the areas to address FIRST are those with:

Addressing risks with low cost-effectiveness ratios means the mitigation efforts are expensive relative to the risk reduction, which is not an efficient use of resources, even for high risks.

Prioritizing low-risk levels, even with high cost-effectiveness, means resources are spent on less critical issues while significant risks might remain unaddressed.

When classifying and prioritizing risk responses, an organization should first address risks that have both a high inherent or residual risk level (meaning they pose a significant threat) and where the proposed mitigation controls offer a high cost-effectiveness ratio. This strategy ensures that resources are allocated efficiently to reduce the most impactful risks, providing the best return on security investment.

Addressing risks with low cost-effectiveness and low risk levels would be a highly inefficient use of resources, as it targets minor issues with poor mitigation ROI.