You really should be performing your own risk assessment so you can convert this notional context-free severity rating to your own context-related impact and l

You really should be performing your own risk assessment so you can convert this notional context-free severity rating to your own context-related impact and likelihood to give you your own company risk rating. Ratings over a certain number (to be agree with at board level - in effect your risk appetite) should be treated (risk remediated, removed, transferred to a third party etc etc). We also do this with pen test reports which suffer the same kinds of issues. Usually find that sometimes a medium is a critical for us and some times a high is a low for us - based on performing this kind of assessment.