3. Vulnerability assessment