30CU  Requirement to undertake vulnerability assessment