test the entity’s preparedness to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and