; (ii) the Administrator orders a change to such provision; and (iii) the ordered change becomes effective. (C) Modification If the Administrator determines that a cybersecurity risk and resilience requirement needs to be changed as a result of a conflict identified under this paragraph, the Administrator shall direct the WRRO to develop and file with the Administrator a modified cybersecurity risk and resilience requirement under this subsection, undertaken pursuant to the processes in paragraphs (1) through (4) above. (e) Water system monitoring and assessment To aid in the development and adoption of appropriate and necessary cybersecurity risk and resilience requirements and modifications to requirements, the WRRO shall— (1) routinely monitor and conduct periodic assessments, including requiring self-attestations of compliance from covered water systems annually and assessments of the covered water system by the WRRO or a designated third party not less than every five years, of the implementation of cybersecurity risk and resilience requirements, and the effectiveness of cybersecurity risk and resilience requirements for covered water systems in the United States