'/%3E%3C/svg%3E){kind=small}
The question nobody asks - until it is too late
A lot gets settled when a machine is handed over: performance parameters, warranty, training. OT data backup? Usually it does not come up.
That comes back to haunt you at the very first outage.
Because then the question arises: Who should have backed up the program states of the OT devices? And who is liable if they are missing?
Who is responsible?
The German NIS2 implementation act has been in force in Germany since the end of 2025. It is clear: responsibility for cybersecurity - and therefore also for OT data backup - lies with the operator. Not with the machine builder.
A machine builder who supplies a program state at handover has, as a rule, fulfilled their obligation. What happens afterwards is the operator's responsibility.
Note: Civil liability between operator and machine builder is a matter of contract. NIS2 only regulates the compliance obligation towards the state - not private-law liability between contracting parties.
Where things go wrong in practice
Four situations that repeatedly cause problems:
Unclear handover: Which OT devices were handed over, in which state? In what format? Usable for which system?
Changes after commissioning: Parameters are adjusted, errors are fixed. Who backs up the changed states of the OT devices?
Remote maintenance by the machine builder: Something is changed remotely. Is it documented?
Multiple machines, multiple manufacturers: Everyone does it differently. The operator has no central overview of their OT devices.
How eguide4DATA solves this
eguide4DATA creates a clear, traceable process - for operators and machine builders alike.
- OT devices are backed up centrally: eguide4DATA automatically and cyclically backs up the program states actually running on all OT devices - with timestamp and user information. Always up to date, always documented.
- The machine builder receives controlled access: The operator assigns user rights to the machine builder in eguide4DATA in a targeted way - only for the relevant machines and OT devices. Control stays with the operator.
- Supplier check-out and check-in: transparency for every maintenance job: Before maintenance, the operator hands the approved version to the machine builder via supplier check-out. After maintenance, the machine builder returns the modified version. The operator performs the supplier check-in and sees exactly what was changed on the OT devices using the compare function - and whether more was changed than agreed.
- Remote maintenance with complete documentation: The operator assigns the machine builder a user in eguide4DATA for the maintenance job. Every change to the OT devices - including via remote access - is recorded automatically and logged as a new version.
Also interesting for machine builders
Anyone who offers their customers a structured handover and maintenance process stands out from the competition - and protects themselves against liability risks. eguide4DATA can be integrated directly into the machine delivery.
See eguide4DATA in action?
In a personal demo, we show how supplier checkout, user rights, and the compare function work in practice.
FAQ: OT Devices & Backup Responsibility
Can the operator transfer the backup responsibility to the machine manufacturer?
The compliance obligation under NIS2 remains with the operator. Individual documentation obligations can be contractually regulated.
Who is liable for damage caused by a remote maintenance change to an OT device?
This depends on the individual case and the contracts. Without neutral documentation, it becomes difficult. With eguide4DATA, every version is time-stamped - the compare function immediately shows what was changed and when.
How does supplier checkout work in practice?
The operator hands over the current approved version to the machine manufacturer via checkout before maintenance. After maintenance, the latter returns the version. The operator uses compare to see what was done on the OT devices - and whether it matches the order.
What does PLUS4DATA recommend for machine handover?
Document the initial program version of all OT devices, the format, and the process for future changes in writing in the handover protocol - and use a central backup solution from the beginning.