The three main components of vulnerability assessment are asset identification, vulnerability and threat assessment, and risk assessment.