This control requires your organization to regularly test its incident response (IR) capability to ensure that processes, personnel, tools, and communications are functioning effectively. Testing can include tabletop exercises, simulated attacks, or live drills.