30AI Direction to vary critical infrastructure risk management program