Audit demands cybersecurity under TRBS 1115 Part 1 — what applies to us in Germany?

The first place they'll check is the remote maintenance modules. Does the VPN or cellular modem the machine tool manufacturer uses for maintenance directly reach the machine's safety network? If your corporate office network and the shop floor (OT) are on the same VLAN, separate them physically or logically right away.

We got a similar warning at our 18-machine mold shop in Bavaria. We paid an external consultant 4.200 EUR, and he prepared our network diagram and risk assessment in two days. The auditor just checked the report confirming the remote access key switch is kept off and that the e-stop cannot be overridden via software, and closed the case.

Don't jump straight into paying 6.500 EUR. Write to your machine manufacturers and request the safety architecture and cyber risk declaration from the CE compliance file for each model. You can start by simply attaching the manufacturer's technical data sheet to your existing risk assessment.

Inspectors have been slapping TRBS 1115 onto every single report lately like a rubber stamp. If the safety relays on your machines are classic dry-contact hardwired setups and can't be overridden via the PLC over the network, you can push back and state the system falls out of scope.

TRBS rules are technical standards, but under BetrSichV Section 3 they trigger a presumption of conformity (Vermutungswirkung). Once you document that you've implemented measures in line with this rule, you're legally covered; otherwise, you could face fault-based liability in the event of an industrial accident.

There are three concrete documents an inspector will want on their desk: 1) A password management matrix and proof that default factory passwords were changed, 2) Temporary service tickets logged to grant remote access to machine vendors, 3) A maintenance logbook showing cybersecurity checks performed at least once a year.

in our shop we put silicone dust caps over the usb ports behind the cnc screens and banned staff from charging phones there. once the inspector saw that he figured we took it seriously and didnt even dig too deep.

don't let it intimidate you they're not expecting bank-grade cybersecurity. the whole point is to keep ransomware from pushing a spindle past its RPM limits and throwing a workpiece into the operator.. and once you get the logic behind it, gathering the ppaerwork only takes a couple of days.

ive been down this road, let me tell you. if 2FA is on a stolen password alone is useless.

the answer varies greatly by industry; there is no one-size-fits-all rule.

Three different views emerged, they all complement each other. Don't rely on a single measure; go layer by layer.

Correct me if I'm wrong.

I'd say don't rush. If it's your first time, start small; scaling comes later.

When making a decision, first look at what data you have on hand. I'm also curious if anyone does it differently.

Great work. Everything goes well for the first three months; problems arise in the fourth.

Hope this helps.

i agree with this and just because everyone does it doesn't mean it's right.

that's all, sorry if I went on too long.

I went through the same thing.

The discussion got scattered, let me summarize. If you get three different answers on a topic, the question was asked wrong.

Of course, it varies if your situation is different.

I agree.

This is exactly what we experienced. Trying to do this alone is the most expensive way.

If you post the result here, it will help others too.

I'm curious too.