OT data backup is often not clearly defined during machine handover. A new machine is delivered, set up, accepted. The machine manufacturer leaves the plant – and leaves behind a USB stick with the program version. The machine is running. Years pass. Nobody has clarified who is responsible for data backup. Until the machine fails. Then the discussion begins.

The question no one asks – until it is too late

At machine handover, many things are defined: performance parameters, warranty, training. OT data backup? Usually not addressed.

This becomes a problem at the latest when the first failure occurs.

Because then the question arises: Who should have secured the program versions of the OT devices? And who is liable if they are missing?

Who is responsible for OT data backup?

The NIS2 Implementation Act has been in force in Germany since the end of 2025. It is clear: Responsibility for cybersecurity – and therefore also for OT data backup – lies with the operator. Not with the machine manufacturer.

A machine manufacturer who provides a program version at handover has generally fulfilled their obligation. What happens afterwards lies with the operator.

Note: Civil liability between operator and machine manufacturer is a matter of contract. NIS2 only regulates the compliance obligation towards the state – not the private law liability between contractual partners.

Where things go wrong in practice

Four situations that repeatedly lead to problems:

• Unclear handover: Which OT devices were handed over with which version? In what format? Usable for which system?
• Changes after commissioning: Parameters are adjusted, errors are corrected. Who secures the modified versions of the OT devices?
• Remote maintenance by the machine manufacturer: Something is changed remotely. Is this documented?
• Multiple machines, multiple manufacturers: Everyone does it differently. The operator has no central overview of their OT devices.

These examples show that the OT data backup in practice is often not clearly defined – with direct impact on operational safety and liability.

Why OT data backup is critical in audits

At the latest in the event of an audit, OT data backup becomes critical. Operators must be able to prove when which program version was active and who carried out changes. Without consistent documentation, this proof is hardly possible.

If this information is missing, this not only leads to compliance risks but also to uncertainty in the event of a failure. Structured OT data backup creates security here – technically and organizationally.

How eguide4DATA solves this

eguide4DATA creates a clear, traceable process – for operators and machine manufacturers.

Central OT data backup

eguide4DATA ensures that OT data backup is centralized, automated and traceable. The actually running program versions of all OT devices are backed up cyclically – with timestamp and user information. Always up to date, always documented.

Controlled access for machine manufacturers

The operator assigns targeted user rights to the machine manufacturer – only for relevant machines and OT devices. Control remains with the operator.

Supplier checkout and checkin

Before maintenance, the operator transfers the approved version via supplier checkout. After maintenance, the machine manufacturer returns the modified version. The operator performs the checkin and uses the compare function to see exactly what was changed – and whether it matches the order.

Complete documentation for remote maintenance

For maintenance work, a user is assigned in eguide4DATA. Every change to the OT devices – including via remote access – is automatically recorded and versioned.

Also interesting for machine manufacturers

Anyone who offers their customers a structured handover and maintenance process stands out from the competition – and reduces liability risks. eguide4DATA can be directly integrated into machine delivery.

See eguide4DATA in action?

In a personal demo, we show how supplier checkout, user rights, and the compare function work in practice.