If an entity undertakes, or causes to be undertaken, a vulnerability assessment under section 30CU, the entity must: