Tabletop exercises are a type of simulation used to test an organization's incident response plan12. They involve key stakeholders in a hypothetical scenario to see how they would respond12. This allows management to assess the effectiveness of the incident response process and identify areas for improvement12. Regularly conducting these exercises ensures that the organization is prepared for a real incident and that the incident response process remains effective over time12.
References:
* Cybersecurity incident response: The 6 steps to success
* Six steps for building a robust incident response strategy - IBM

The finding that should be ranked as the highest risk is that network penetration tests are not performed.
Network penetration tests are simulated cyberattacks that aim to identify and exploit the vulnerabilities and weaknesses of the network security controls, such as firewalls, routers, switches, servers, and devices.
Network penetration tests are essential for assessing the effectiveness and resilience of the network security posture, and for providing recommendations for improvement and remediation. If network penetration tests are not performed, the organization may not be aware of the existing or potential threats and risks to its network, and may not be able to prevent or respond to real cyberattacks, which can result in data breaches, service disruptions, financial losses, reputational damage, and legal or regulatory penalties. The other findings are also important, butnot as risky as the lack of network penetration tests, because they either do not directly affect the networksecurity controls, or they can be addressed by documentation or approval processes. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.4

Machine shredding is the process of using a shredding machine to physically destroy the media and make the data unrecoverable. This is more effective than software formatting, which only erases the data logically and may leave traces that can be recovered by special tools1. Encrypting and destroying keys may prevent unauthorized access to the data, but it does not erase the data from the media. Wiping and rewriting three times is unnecessary and may reduce the lifespan of the media, especially for solid state drives2. Machine shredding is also recommended by various security standards and guidelines for media disposal345.

A firewall between internal network segments improves security and reduces risk by inspecting all traffic flowing between network segments and applying security policies. This will prevent unauthorized or malicious access, data leakage, or network attacks from compromising the network resources or data. Logging all packets passing through network segments may provide audit trails and evidence, but not prevent or mitigate security incidents. Monitoring and reporting on sessions between network participants may help to identify anomalous or suspicious activities, but not block or filter them. Ensuring all connecting systems have appropriate security controls enabled may enhance the overall network security posture, but not isolate or segregate different network segments. References: Info Technology & Systems Resources | COBIT, Risk, Governance ... - ISACA, section "Book COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution | Digital | English"