There are 3 classes of servers all with same critical vulnerability: public facing server, production databases with PII on it, and an office file share. Which one would you address first?