One standard way to prioritise defects is to use the following two factors and multiply them and deal with the high numbers:

Likelihood - 1 (really unlikely) to 5 (almost certain to occur)

Severity - 1 (cosmetic) to 5 (business critical)

This means that each defect is rated 1 to 25. Obviously 25s HAVE to be resolved but anything 5 and under are usually optional. Different places I have seen this have often had thresholds set for both ensuring and deferring resolution. Some have had an additional rule that all severity 5s must also be fixed.

Perhaps this should be, or even may be being, applied in Disaster Recovery planning.