Mechanisms exist to formally test incident response capabilities through realistic exercises to determine the operational effectiveness of those capabilities.
Does the organization formally test incident response capabilities through realistic exercises to determine the operational effectiveness of those capabilities?