the reasonableness and proportionality of applying the statutory incident response planning obligations to the entity in relation to: