30AQ Reporting obligations relating to certain assets that are not covered by a critical infrastructure risk management program