if the exercise relates to one or more specified types of cyber security incidents—the purpose of which is to: