A scanner identifies a critical weakness on an isolated laboratory host with no sensitive data. What should the practitioner do before assigning business risk?

1. Exclude every laboratory asset from assessment
2. Assess exposure, plausible threat paths, controls, and consequences
3. Assign the maximum business impact automatically
4. Use remediation cost as the sole likelihood measure