30AJ Variation of critical infrastructure risk management program