If an entity is the responsible entity for one or more critical infrastructure assets, the entity must:

a critical infrastructure risk management program that applies to the entity.

Civil penalty: 200 penalty units.