Since January 2026, the Technical Rule for Operational Safety 1115 Part 1 (German: TRBS 1115 Teil 1) has applied in an amended version. For the first time, it provides inspectors with a concrete benchmark. For a finding, it is sufficient that a protection concept is missing. Whether a cyberattack has ever taken place is irrelevant. We show the standards against which operators and installations will have to measure themselves in future.
In a nutshell
- The Technical Rule for Operational Safety (TRBS) 1115 Part 1 defines cybersecurity measures for operational technology (OT).
- Since 15 January 2026, an amended version of TRBS 1115 Part 1 has applied, which allows plant operators to implement concrete measures and provides approved inspection bodies (ZÜS) with specific inspection criteria.
- TRBS 1115 Part 1 is available in full text (in German) from the Federal Institute for Occupational Safety and Health (BAuA).
What is TRBS 1115 Part 1 and what legal effect does it have?
The Technical Rules for Operational Safety (TRBS) are sub-statutory sets of rules which are determined by the Committee on Operational Safety and published by the Federal Ministry of Labour and Social Affairs in the Joint Ministerial Gazette (GMBl). The TRBS specify the abstract requirements of the Ordinance on Industrial Safety and Health (BetrSichV) and describe the state of the art.
Part 1 of TRBS 1115 is a self-contained regulatory part which deals exclusively with the cybersecurity of safety-related measuring, control and regulating devices (MCR devices). The legal basis, Section 8(2) BetrSichV, requires technical protective measures and their permanent functionality. TRBS 1115 Part 1 specifies precisely this point with regard to cyber threats and thus supplements the main rule TRBS 1115 as well as TRBS 1201 on the inspection of work equipment.
TRBS 1115 Part 1 was published in March 2023; the amended version has applied since 15 January 2026.
From a legal perspective, the decisive factor is the so-called presumption of conformity: Anyone who complies with the TRBS may assume that they fulfil the corresponding requirements of the BetrSichV, both during an inspection and after an accident. The rule is therefore not a law in the formal sense, but is binding in practice.
Deviations remain permissible, but they shift the burden of proof, because employers must then demonstrate that their solution offers at least the same level of protection for employees. In the area of cybersecurity, this proof is regularly more onerous than applying the rule itself.
To whom does TRBS 1115 Part 1 apply and when does an installation fall outside its scope?
TRBS 1115 Part 1 is addressed to the employer or the operator of work equipment or of an installation subject to monitoring with safety-related MCR devices. The obligations of machinery manufacturers, by contrast, are governed by the EU Machinery Regulation and the Cyber Resilience Act (CRA) and are not addressed in TRBS 1115.
Typically affected are pressure installations, installations in potentially explosive atmospheres, and lift installations; in addition, all work equipment whose safety function is realised by means of MCR technology, i.e. for example interlocks, burner and firing systems, autoclaves, or safety switching devices.
Two questions are decisive for the scope of application, which must be answered one after the other:
- Firstly, it must be determined whether the system is part of, or an influencing variable of, a safety function. The decisive factor is the sensor–logic–actuator chain of a documented protective function, i.e. limit value monitoring, interlocking, shutdown, or the bringing about of a safe state.
- Secondly, it must be examined whether there is an interface via which this function can be impaired.
The rule does not apply if there is no external interface whatsoever. A purely mechanical pressure switch which physically triggers a valve in the event of overpressure cannot be attacked, as it has no electronics and no software. Conversely, a single service port is already sufficient: An offline pressure control system on which a technician parameterises the trigger threshold once a year via USB cable falls within the scope of application, because anyone who changes the limit value from 8 to 20 bar unnoticed overrides the protection, without any network access at all.
The decisive guiding question is therefore not whether a device is connected to the network, but whether someone can use it to override a protective function. A networked camera for quality monitoring does not perform a safety function and is therefore not the focus of TRBS 1115 Part 1, although it is technically more exposed than the offline control system mentioned above.
What specifically did the 2026 amendment change in TRBS 1115 Part 1?
The amendment of TRBS 1115 Part 1 pursues the declared objective of practical relevance and better auditability. Since many employers cannot yet have many years of experience with cybersecurity, the requirements of the Technical Rule have been specified by means of explanations and examples. Three points characterise the new version.
Extension to equipment requiring protection
First, Annex 2 of TRBS 1115 Part 1 introduces the term equipment requiring protection, which deliberately obliges a consideration that extends beyond safety-related MCR devices and may cover other parts of work equipment. This may include:
- safety-related equipment without MCR character, such as emergency call and emergency control devices,
- furthermore, the IT/OT environment of these systems with service and programming devices or
- gateways, as well as non-safety-related MCR devices whose compromise may nevertheless lead to a relevant hazard through interactions.
Anyone who limits the scope of their consideration solely to safety controllers therefore falls short.
Permanent assurance of the effectiveness of measures
Secondly, the inspection requirements in Sections 6 and 7 have been specified. For work equipment with cybersecurity-relevant MCR devices, it must in future be documented in a traceable manner how the effectiveness of the cybersecurity measures is permanently ensured. The inspection of cybersecurity is expressly part of the inspection of the work equipment and specifically not a separate IT audit.
Changed systematics based on interfaces and networking
Thirdly, Annex 2 as such has been added. It contains explanations and graduated case examples for the required scope of cybersecurity measures. Its systematics are no longer based on types of installation, but on the type of interfaces and the degree of networking, which proves to be a considerably more robust structure in practice.
How does the new Annex 2 of TRBS 1115 Part 1 help in determining the scope of measures?
Annex 2 describes six scenarios, ranging from the installation without interfaces to the installation controlled entirely via the OT network. Each scenario is assessed according to the same categories, namely:
- segmentation,
- rules on system access and access rights,
- hardening of components,
- independence of the safety-related MCR devices,
- monitoring and
- emergency management.
The Technical Rule thus provides, for the first time, a reference benchmark against which operators can benchmark their own specifications.
Of particular interest is the graduation:
- In the case of work equipment with a wired interface and no further networking, it is essentially sufficient to include the configuration device in the consideration, to rule out a permanent connection, to deactivate hardware interfaces that are not required, and to make the use of the configuration device traceable.
- In the case of work equipment monitored via the OT network, the requirement increases significantly, because there the rule requires that, while status information may flow outwards, the work equipment cannot accept any information or commands from other services, which can expressly also be implemented by means of a data diode.
- In the case of work equipment controlled entirely via the OT network, Annex 2, by contrast, refrains from general requirements and refers to a system-specific risk assessment in accordance with established methods such as ISO/IEC 27001, ISO/IEC 27002, IEC 62443-2-1 or the IT-Grundschutz of the Federal Office for Information Security (BSI).
Furthermore, Annex 2 names the actors to be taken into account. Persons without access authorisation who act remotely via permanent or temporary connections must be included as a mandatory requirement, as well as persons with access authorisation who, through reasonably foreseeable misuse, make an attack possible in the first place, for which the impermissibly used USB stick is regarded as the classic example. Whether, beyond this, criminal acts by persons with access authorisation are to be considered is decided by the employer on the basis of the possible effects, and the employer documents this decision.
An assessment based on statistics of incidents that have become known to date is not sufficient. The argument that nothing has happened so far regularly does not hold.
Which requirements must an establishment permanently fulfil under TRBS 1115 Part 1?
The structure of TRBS 1115 follows the life cycle of work equipment. Cybersecurity must already be taken into account during planning and implementation and documented in a cybersecurity protection concept, which may also be drawn up as a supplement to the functional safety protection concept. The identification and assessment of cyber threats forms part of the risk assessment pursuant to Section 3 BetrSichV and Section 5 of the Occupational Safety and Health Act (ArbSchG). Because these documents are extensive, it is permissible to refer to subordinate documentation in the risk assessment.
On the organisational side, it is required to assign responsibilities, define access rights, and ensure the necessary expertise of the personnel. Persons authorised to make determinations require expertise appropriate to the task; all other persons involved require at least knowledge of the measures applicable in their area of responsibility. On the technical side, there are rules on system access and access rights, segmentation, the independence of safety-related MCR devices from the other systems, monitoring, and emergency management.
Particular attention must be paid to freedom from interference, which is regularly problematic in practice. Cybersecurity measures must not impair the function of the systems requiring protection. A firewall that delays safety-related communication, or an authentication that blocks access to the operator station in the event of an incident, solves a cyber problem but at the same time creates a functional safety problem. Annex 2 therefore requires that this interaction be considered and documented.
Example: In a medium-sized manufacturing company, a control system that monitors several safety-related shutdown chains is to be consistently separated from the office network. The design provides for all data flows to be routed via a central firewall, including the status messages to maintenance.
The assessment of freedom from interference shows that the firewall’s rule set evaluation could delay the reporting of a limit value alarm by several seconds, which noticeably shortens the reaction time of the operating personnel in the event of an incident.
The solution could then consist of routing the signalling paths out unidirectionally and keeping the control commands entirely within the zone, while the firewall only secures the engineering access. Segmentation would thus be maintained without slowing down the safety function.
It is precisely this weighing that TRBS 1115 Part 1 expects as a documented result, not as a tacit decision of the project team.
How is cybersecurity inspected in accordance with TRBS 1115 Part 1?
The inspection is not carried out in a separate procedure, but as part of the inspections of the work equipment that are mandatory in any case. Before commissioning and before recommissioning following a modification requiring inspection, it must be inspected pursuant to Sections 14 and 15 BetrSichV whether the intended cybersecurity measures are suitable and functional. Who carries out the inspection is determined by the general inspection regime of the BetrSichV, so that, depending on the work equipment, a person qualified to carry out inspections or an approved inspection body (ZÜS) carries out the inspection.
The periodic inspection pursuant to Sections 14 and 16 BetrSichV goes beyond this. The inspecting person must verify how the suitability and functionality of the measures are permanently achieved and determine whether any requirements exist at all for the regular checks pursuant to Section 4(5) sentence 3 BetrSichV. In addition, it must be examined whether changes have been assessed in both directions, i.e. whether modifications to the MCR devices requiring inspection have been considered with regard to their effects on the cybersecurity measures and whether, conversely, changes to the cybersecurity measures have been examined for possible repercussions on the MCR devices. Finally, it must be verifiable whether new findings, for example from vulnerabilities that have become known, have been taken into account and the measures adapted where necessary.
These are to be distinguished from the obligations incumbent on the employer itself. Before first use, the effectiveness of the cybersecurity measures must be reviewed; this does not apply if they are inspected pursuant to Sections 14 or 15 BetrSichV in any case. In addition, regular checks of functionality must be carried out on an ongoing basis by competent, designated and instructed employees or by comparably qualified contractors, the type and scope of which are determined by the risk assessment.
The inspection of suitability is essentially a process inspection, because suitability can be assumed if all steps of Section 4 of TRBS 1115 Part 1 have been carried out correctly in a traceable manner. For this purpose, Annex 2 sets out a catalogue of questions that operators can use directly as a self-check.
- Have all safety-related MCR devices and other equipment requiring protection been recorded and documented?
- Have the effects of a loss of integrity and availability been identified and the resulting hazards assessed, expressly without taking into account existing or planned protective measures?
- Have the cybersecurity measures been determined in a traceable manner, are they plausible and are they aligned with the standard measures of Section 4.5.2?
- Are there manufacturer specifications and have they been taken into account?
- Do procedures exist for maintaining the level of cybersecurity, for example for software updates and security-relevant patches?
- Have the organisational measures been implemented in operating instructions and has freedom from interference with the systems requiring protection been considered?
- Have sufficient provisions been made for the inspection and for checking the functionality of the measures?
The inspection of functionality then compares the actual state with the protection concept and the cybersecurity specification and determines whether the intended inspections and the organisational measures have actually been implemented. If the employer operates a cybersecurity management system in accordance with Annex 1, the inspecting person may adopt its results, and the documentation available there simultaneously fulfils the documentation obligations pursuant to Section 3(8) BetrSichV. If there is no such management system, the inspecting person can at least adopt the results of the effectiveness review, provided that the performance and result are verifiable by them. Both provisions are a strong argument for properly documenting one’s own checks and not merely carrying them out.
What happens in the event of findings in the course of the inspection?
If the inspection is negative, the usual escalation scheme of the ZÜS regime applies to installations subject to monitoring. Defects are classified according to their severity, whereby minor defects lead to a deadline for rectification, significant defects trigger a re-inspection, and dangerous defects must be reported to the competent authority without delay. The competent authority may order measures up to and including the shutdown of individual installations, so that affected installations may not continue to be used until the defects have been remedied and a re-inspection has taken place.
The decisive point is that, for a finding, it does not matter whether a cyberattack has ever taken place. The mere absence of a documented protection concept may suffice, and the economic consequences of a single production stoppage generally exceed the implementation costs considerably.
Is an existing ISMS in accordance with ISO 27001 sufficient?
An existing information security management system (ISMS) in accordance with ISO/IEC 27001 is generally not sufficient without extension. Existing management systems may be used, but the TRBS requires two documented answers for this:
- On the one hand, it must be demonstrated that the existing requirements actually cover all equipment for which cybersecurity measures are required.
- On the other hand, it must be substantiated that the measures determined are sufficient to protect employees and, in the case of installations subject to monitoring, also other persons in the danger zone in accordance with the requirements.
A classic ISMS in accordance with ISO/IEC 27001 is geared towards information assets and frequently does not cover plant safety and the safety of persons. An extension is possible and usually an efficient approach, but it must expressly extend the scope of consideration to equipment requiring protection and switch the assessment logic from damage to information to hazards to persons. Anyone who skips this step has a certified management system and nevertheless has a gap with regard to TRBS 1115 Part 1.
Conclusion: The rule measures the process, not chance
TRBS 1115 Part 1 does not require a perfect security architecture, but a traceable process of recording, assessing, determining, implementing, inspecting, and updating, which is documented throughout. With the version applicable since 15 January 2026, this benchmark is, for the first time, so concrete that operators and inspectors alike can work with it.
The sensible next step remains manageable. Use the catalogue of questions from Annex 2 to check whether a documented protection concept exists for your equipment requiring protection, whether the expertise has been designated and whether the effectiveness of the measures is being checked.
Then assign your work equipment to the six scenarios of the Annex, as this provides a reliable picture of the gap to the required target state within a few days. The date on which this gap becomes visible is, in any case, already fixed by the next periodic inspection.