Each system component has to be identified and rated by ____________, when conducting a vulnerability assessment for a system?