This control requires organizations to fix identified vulnerabilities based on the risk they pose, not just the order they were found or how easy they are to fix. Remediation efforts must be risk-based, prioritized, and tracked.
Read the full blog breakdown of 3.11.3