Each door is one change, ordered by the exposure it removes and the certification requirements it completes per hour of work. Fixes interact, so the order is recalculated after every one.
−1.9 exposure3 hoursDEV-001
Non-compliant devices are ones that have drifted from your security baseline - missing updates, disabled protections or no PIN.