the entity has adopted an incident response plan that applies to the entity;