Mechanisms exist to include simulated actual cyber-attacks through practical exercises that are aligned with current threat scenarios.
Does the organization include simulated actual cyber-attacks through practical exercises that are aligned with current threat scenarios?