30CU Requirement to undertake vulnerability assessment