This section applies if an entity has undertaken a cyber security exercise under section 30CM, and: