A critical infrastructure risk management program may be varied, so long as the varied program is a critical infrastructure risk management program.