Vulnerability assessment should take place before the deployment of new systems, during the upgrades of existing systems, and after previous vulnerabilities have been patched.