Assessing & Documenting Device-Vulnerability Risk