Vulnerabilities discovered during an assessment should be:

handled as a risk, even though there is no threat.

prioritized for remediation solely based on impact.

a basis for analyzing the effectiveness of controls.

evaluated for threat, impact and cost of mitigation.

I need typed answer with explanation