the entity adopts an incident response plan that applies to the entity;