If an entity undertakes a cyber security exercise under section 30CM, the entity must: