The next step to determine the risk exposure after a vulnerability assessment of a web-facing application is to perform a penetration test. A penetration test is a simulated attack on the application to exploit the identified vulnerabilities and measure the potential impact and likelihood of a successful breach. A penetration test can help to quantify and prioritize the risks associated with the web-facing application. Code review, gap assessment, and business impact analysis (BIA) are other possible steps, but they are not as effective as a penetration test. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 7; CRISC Review Manual, 6th Edition, page 202.