The responsible entity for a system of national significance may be required to undertake a cyber security exercise.