adopting another critical infrastructure risk management program that applies to the entity.