How is vulnerability defined and described in the plan?