or not to mitigate such vulnerability. The Administrator shall prioritize mitigating vulnerabilities based on their ability to reduce risk. If the Administrator determines— (A) to not mitigate such vulnerability, the Administrator shall document the reasons for the decision