If an entity has adopted a critical infrastructure risk management program that applies to the entity, this Part does not prevent the entity from: