Requirements for vulnerability scoring