The responsible entity for a system of national significance may be required to undertake a vulnerability assessment.