A security assessment ranks systems by server count, but one small system processes most customer payments. What should drive its priority?

1. Server count only
2. Business impact and relevant exposure
3. The system's vulnerability count without reference to transaction value
4. The total number of administrators across the largest server estate