Can my IT staff perform a vulnerability assessment?

Yes, of course your IT staff are able to do these assessments.

However, it depends on the certifications, skills, and focus of your staff. The most common pitfall found is that the IT staff are too “complacent, and not outsiders” such that they are bound to overlook their own errors.

Thus, it is better to let UFI as an impartial, “third party” do the vulnerability assessment.