adopting another incident response plan that applies to the entity.