How should we answer?

Use the weakest material part of the environment, not the strongest example. If one of several critical services has no owner or reliable evidence, do not answer as if all are covered.

For each response, record the evidence location, owner, date and unresolved exception. “Tested” means an authorized, relevant exercise with an observed result; it does not require disruptive live testing. A document can establish a responsibility, while an exercise establishes whether people can execute it.