the entity varies an incident response plan that applies to the entity;