; or (II) invite the WRRO to engage in negotiations with the Administrator to reach consensus to address the specific recommendation made by the Administrator under subparagraph (A). (4) Effective date The effective date of a cybersecurity risk and resilience requirement or modification to such a requirement proposed under this subsection shall be set by the Administrator in accordance with the proposed implementation plan submitted by the WRRO under paragraph (1). (5) Submission of specific requirement The Administrator, upon the Administrator’s own motion or upon complaint and having a reasonable basis to conclude existing recommendations under the WRRO are insufficient, when implemented by covered water systems, to protect, defend, mitigate, or recover from a cybersecurity incident, may, following consultation with the WRRO, order the WRRO to submit to the Agency a proposed cybersecurity risk and resilience requirement or a modification to such a requirement that addresses a specific matter if the Administrator considers such a requirement or modified requirement necessary to protect, defend, mitigate, or recover from a cybersecurity incident. (6) Conflict (A) In general The final rule adopted under subsection (b)(2) shall include specific processes for the identification and timely resolution of any conflict between a cybersecurity risk and resilience requirement and any function, rule, order, tariff, or agreement accepted, approved, or ordered by the Administrator applicable to a covered water system. (B) Compliance A water system shall continue to comply with such function, rule, order, tariff, or agreement approved, or otherwise accepted or ordered by the Administrator unless— (i) the Administrator finds a conflict exists between cybersecurity risk and resilience requirement and any such provision; (ii) the Administrator orders a change to such provision