the vulnerability assessment process