the entity has adopted a critical infrastructure risk management program that applies to the entity;