Evidence of Recent Exercise for Incident Response

Hello folks, I am new to cybersecurity and need your help. Our client has initiated TPRM (Third Party Risk Management) and has been requesting details regarding evidence of a recent exercise conducted for Incident Response. I do know that companies use tools such as GoPhish, etc., to conduct phishing exercises. What else is actually required here? We are not currently conducting any Incident Response exercises, but if asked, we may have to conduct something. As of now, we are only …

client companies cybersecurity etc exercise exercises hello incident incident response management party phishing response risk risk management third third party risk tools tprm