A critical infrastructure risk management program is a written program: