11.4.4—Exploitable vulnerabilities and security weaknesses found during penetration testing are corrected as follows: In accordance with the entity’s assessment of the risk posed by the security issue as defined in Require ment 6.