is, or is included in, a critical infrastructure risk management program that is adopted by an entity in compliance with section 30AC; or