How can we test incident response plans in the cloud, where you have only limited control over the cloud-based infrastructure on which we are dependent?