Part 2AA—Reporting obligations relating to certain assets that are not covered by a critical infrastructure risk management program