When communicating the findings of a network vulnerability scan to a client's IT department which of the following metrics BEST prioritize the severity of the findings? (Select TWO)

Threat map statistics show geographic or temporal attack trends and do not quantify the severity of any specific vulnerability identified in the scan.

CVSS provides a universally recognized numerical score derived from exploitability, attack vector, scope, and impact metrics, allowing direct comparison of severity across all reported vulnerabilities. It is the industry standard for communicating technical risk and is understood by both security practitioners and IT management.

Software version data identifies which systems are affected but does not itself convey how severe the vulnerability is or what business risk it represents.

Media coverage reflects public attention to a vulnerability rather than its actual exploitability or impact within the client's specific environment.

Impact criticality maps technical vulnerabilities to their potential effect on the confidentiality, integrity, and availability of specific business systems, translating raw scanner findings into organizational risk that IT teams can use to justify and sequence remediation efforts.

Ease of remediation describes the operational effort required to fix a finding and measures effort, not severity - a trivial-to-fix vulnerability may still be low priority if its impact is minimal.