test the entity’s ability to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and