How do we practically test our newly created incident response plan without disrupting daily client operations?