Customer vulnerability policy