What is the best practise for classing a machine as highly vulnerable or vulnerable in the system health policy?