A relevant official may give the responsible entity for one or more critical infrastructure assets a written direction to vary the entity’s critical infrastructure risk management program if the relevant official is satisfied that there are one or more serious deficiencies with the program.