; and (2) annually submit to the Administrator a report on the implementation of cybersecurity risk and resilience requirements, the effectiveness of cybersecurity risk and resilience requirements for covered water systems in the United States, provided that such reports shall only include aggregated or anonymized findings, observations, and data, and shall not contain any sensitive security information. (f) Enforcement (1) In general The WRRO may impose, subject to paragraphs (2) and (4), a penalty on an owner or operator of a covered water system for a violation of a cybersecurity risk and resilience requirement approved by the Administrator under subsection (d) if the WRRO, after notice and an opportunity for a hearing— (A) finds that the owner or operator of a covered system has violated or failed to comply with a requirement approved by the Administrator under subsection (d)