Once an organization decides that it wishes to conduct vulnerability scanning and determines which, if any, regulatory requirements apply to their scans, they move on to the more detailed phases of the planning process. The next step is to identify the systems that will be covered by the vulnerability scans. Some organisations choose to cover all systems in their scanning process, whereas others scan systems differently (or not at all) depending on the answers to many different questions, including - What is the data classification of the information stored, processed, or transmitted by the system? - Is the system exposed to the Internet or other public or semipublic networks? - What services are offered by the system? - Is the system a production, test, or development system? Organisations also use automated techniques to identify the systems that may be covered by a scan. Cybersecurity professionals use scanning tools to search the network for connected systems, whether they were previously known or unknown, and to build an [[Asset Management|asset inventory]].