30CUÂ Requirement to undertake vulnerability assessment