If an entity has adopted an incident response plan that applies to the entity, this Division does not prevent the entity from: