The company formally plans and conducts simulated incident exercises on a regular basis
A written commitment to run simulated incident exercises at a set frequency is how a company proves its plan was built to be tested, not filed away.
A written commitment to run simulated incident exercises overlaps with ICT readiness testing, though its primary scope is incident response rather than recovery capability.