A team prioritizes every recommendation solely by its contribution to secure score. What additional factor should guide remediation order?

1. Ignore every internet-exposed critical workload if its score effect is small
2. Only the oldest resource creation date
3. Actual exposure, exploitability, business impact, and the affected dependency chain
4. Only the alphabetical resource name