After the components are identified in a vulnerability assessment what is the next step?