test the entity’s ability to mitigate the relevant impacts that those types of cyber security incidents could have on the system; and