Please follow
https://www.uspsoig.gov/document/system-vulnerability-assessment
.