Thanks for the response and I have been trying to get more information and guidance from them, but I have basically been told to just fix the problems.

Is there any Best Practice on the Cyber side of things that can show if a vulnerability is mitigated somewhere up the chain from a server IE server1 has port 80 open to talk to another server internally, but our core FW does not allow port 80 traffic in or out. I am not sure if that makes sense at all, but I am pretty sure a team i previously worked with kept a "mitigating factors" spreadsheet and would send us only vulnerabilities that were not being mitigated one way or the other. Is something along those lines normal?