a critical infrastructure risk management program that applies to the entity.