filed not later than 30 days after notice of such penalty is filed with the Administrator. (C) Stay of penalty A penalty under review by the Administrator under this paragraph may not be stayed unless the Administrator otherwise orders that such penalty be stayed upon the Administrator’s own motion or upon application by the owner or operator of the covered water system owner or operator that is the subject of such penalty. (D) Proceeding (i) In general In any proceeding to review a penalty imposed under paragraph (1), the Administrator, after notice and opportunity for hearing (which hearing may consist solely of the record before the WRRO and opportunity for the presentation of supporting reasons to affirm, modify, or set aside the penalty), shall by order affirm, set aside, reinstate, or modify the penalty, and, if appropriate, remand to the WRRO for further proceedings. (ii) Expedited procedures The Administrator shall act expeditiously in administering all hearings under this section. (g) Savings provision (1) Authority Nothing in this Act authorizes the WRRO or the EPA Administrator to develop cybersecurity binding risk and resilience requirements for covered water systems, except as defined by this act. (2) Rule of construction Nothing in this section may be construed to preempt any authority of any State to take action to ensure the safety, adequacy, and resilience of water service within that State, as long as such action is not inconsistent with or conflicts with any cybersecurity risk and resilience requirement. (h) Status of WRRO The WRRO certified under subsection (c) is not a department, agency, or instrumentality of the United States Government. (i) Authorization of appropriations There is authorized to be appropriated to carry out this subsection $5,000,000 for each of fiscal years 2024 and 2025, to remain available to the WRRO until expended.