15-minute digest: 2026-09-30

• Small water utilities: EPA's checklist turns cybersecurity into one measurable fix: EPA's checklist lets water systems serving fewer than 50,000 people pick one cybersecurity practice, prove it and improve it.
• Who decides a factory is safe to restart after a cyberattack?: Restarting after an incident is a decision with an owner and an evidence list. It can be rehearsed before it's needed.
• Coast Guard: the IT/OT connection is what raises maritime cyber risk: The Coast Guard says the link between business systems and operational systems is where maritime cyber risk grows.