A routine vulnerability scan detected a known vulnerability in a critical enterprise web application. Which of the following would be the BEST next step?

A. Submit a change request to have the system patched.
B. Evaluate the risk and criticality to determine if further action is necessary.
C. Notify a manager of the breach and initiate emergency procedures.
D. Remove the application from production and inform the users.