; and (B) files notice and the record of the proceeding with the Administrator. (2) Notice The WRRO may not impose a penalty on an owner or operator of a covered system under paragraph (1) unless the WRRO provides the owner or operator with notice of the alleged violation or failure to comply with a cybersecurity risk and resilience requirement and an opportunity for a consultation and a hearing prior to finding that the owner or operator has violated such requirement under paragraph (1)(A). The owner or operator of a covered water system may engage legal Counsel to take part in the consultation and hearing Requirements. (3) Effective date of penalty A penalty imposed under paragraph (1) may take effect not earlier than the 31st day after the WRRO files with the Administrator notice of the penalty and the record of proceedings. (4) Imposition of penalty A penalty imposed under paragraph (1) shall not exceed $25,000 per day the entity is in violation of a cybersecurity risk and resilience requirement. (A) A penalty imposed under this subsection shall be the only penalty imposed for the violation. The Administrator is barred from imposing additional penalties on the covered water System for the same violation. (B) Any penalties collected will be returned to the WRRO to support training initiatives and support other resource capabilities of the WRRO in carrying out its duties under this Act. (5) Review by administrator (A) In general A penalty imposed under paragraph (1) may be subject to review by the Administrator. (B) Application for review The Administrator may conduct a review under subparagraph (A) on the Administrator’s own motion or upon application by an owner or operator of a covered water system that is the subject of a penalty imposed under paragraph (1) filed not later than 30 days after notice of such penalty is filed with the Administrator. (C) Stay of penalty A penalty under review by the Administrator under this paragraph may not be stayed unless the Administrator otherwise orders that such penalty