Before we can even think of starting the vulnerability assessment, it is extremely important to very clearly understand customer requirements. The customer may be internal or external to the organization. For a VA tester, it is important to know what the customer is expecting from the test. In order to identify and document the customer requirements, the following things need to be done.