The penalty factor refers to the consequences of not implementing a given requirement.

If, for example, a financial fine or other penalties will be incurred by the organization if a specific requirement is not met, that requirement will have a higher priority associated with it.