test the entity’s ability to mitigate the relevant impacts that all types of cyber security incidents could have on the system; and