If an entity is the responsible entity for one or more critical infrastructure assets, the entity must: