As you prepare your POAM, you must consult FIPS 199 to define its Impact Level: Low, Moderate, High, and (in some instances) Critical. While you may be inclined to address the Highest Impact vulnerabilities first - not a bad strategy, of course - you may find that some of your Low Impact vulnerabilities have a higher visibility and therefore are more likely to impact you if unaddressed. You should view all of your POAMs and their sub-tasks collectively and collaboratively within your organization to prioritize in a manner that works best for you.