the entity had a critical infrastructure risk management program that applied to the entity.