the purpose of which is to plan for responding to cyber security incidents that could have a relevant impact on the system; and