test the entity’s ability to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and