the recipient has established a process to develop, maintain, and execute a written plan for identifying and reducing cybersecurity risks. (2) Compliance For the process required under paragraph (1), a recipient of assistance under this chapter shall— (A) utilize the approach described by the voluntary standards and best practices developed under section 2(c)(15) of the National Institute of Standards and Technology Act ( 15 U.S.C. 272(c)(15) ), as applicable