The move is consistent with the agency's advice on the need for organizations to prioritize the vulnerabilities that actually matter.