A company has written incident runbooks but has never exercised them across security, operations, and business owners. What is the most useful next step?

1. Measure only the number of pages in the runbook.
2. Run scoped tabletop and technical simulations with clear objectives and follow-up improvements.
3. Trigger an uncontrolled production outage without notifying responsible teams.
4. Assume written procedures guarantee operational readiness.