Why USB sticks in OT are the greatest risk to your production

The USB stick in the second drawer on the left

Ask in any production hall how the states of your OT devices are backed up. The answer is alarmingly often the same: "There's a stick somewhere." Sometimes it's in the control cabinet. Sometimes at the maintenance technician's home. Sometimes nobody knows anymore.

That sounds like a marginal problem. It isn't.

In a plant where one hour of production downtime costs 20,000 euros, a missing or outdated device state in the event of a fault is not an organizational problem. It is an economic disaster.

Six scenarios that happen every day

Scenario 1: The stick is gone

Technicians change. The new one doesn't know where the stick was. The old one has been in another department for three months. The plant is down - and the stick is nowhere to be found.

Scenario 2: The state is outdated

The last backup was eight months ago. Since then, five optimizations have been made to the device. The stick contains the old state. Which one is valid? Who still knows?

Scenario 3: The plant is running, the state is not

The stick wasn't written to after the last change. The technician was in a hurry. The current state of the OT device is stored nowhere - except on the device itself. If it fails, the state is lost.

Scenario 4: "Was that really the latest state?"

A plant is just being put back into operation. The question hangs in the air: does the server - or the stick - really hold the state from an hour ago, or the one from yesterday morning? Nobody can say for sure. This hesitation, this uncertainty, is a warning sign. If nobody in the room can say exactly when the last backup was created and whether it really reflects the current state of the OT device, then a central element of any serious OT backup strategy is missing: traceability. Anyone who has to act at that moment lacks the foundation to do so.

Scenario 5: Malware via USB

USB sticks are the most common entry point for malware in OT networks. According to the BSI, uncontrolled use of USB devices in industrial environments is one of the main risk factors for cyberattacks on production systems.

Scenario 6: The audit

An auditor asks for the backup documentation. You show a basket of USB sticks. That is not sufficient proof of NIS2-compliant data backup.

Why this practice is so persistent

USB sticks are convenient, they work - and the alternative initially seems complicated to many companies. There is no central system that needs to be set up. There is no training required. You simply plug in, save, done.

The problem: this simplicity is deceptive. It works exactly until the moment when it really matters.

And in that moment, there is no time for improvised crisis management.

What NIS2 says about USB

The NIS2 directive makes no explicit statement about USB sticks. But it explicitly requires documented, testable backup processes and integrity evidence for critical OT systems.

A USB stick meets none of these requirements. It is not documented, not automated, not centrally manageable, not auditable.

Companies that describe their OT backup strategy in an audit as "USB sticks at the maintenance technician's" will very likely be asked to improve immediately.

The role of service providers: an underestimated risk

In many production environments, it is not only internal technicians who work on OT devices. Service providers - external maintenance contractors, machine manufacturers or commissioning teams - regularly access plants, make changes and often leave behind a new, unsecured device state.

The problem: who took a backup after the service visit? Was it the external technician - on their stick? Or internal maintenance - who didn't even know about the visit?

A structured OT backup solution must explicitly cover this case: service provider access must be documented, changes traceable and new device states backed up immediately - regardless of who made the change.

Checkout & check-in: handing over versions without losing control

An often neglected requirement in OT: what happens when a service technician or an internal employee needs the state of an OT device for maintenance or optimization - and then loads an adjusted version back?

Without a structured process, the next version chaos arises right here.

eguide4DATA therefore supports a controlled supplier check-out and check-in process: a defined device state is checked out in a controlled manner, edited and then checked back in - with complete version history, user log and traceability. This turns knowledge transfer between internal teams and external service providers into a regulated routine - instead of a source of errors.

The structured alternative: central OT backup

What do you need instead? At its core:

• Automation: Backups of all OT devices are created cyclically and automatically - without anyone having to take action.
• Central storage: All device states, all versions, in one place - with a clear version history and user log.
• Integrity: The system checks whether backups are complete and restorable.
• Alerting: If a backup fails or a deviation is detected, the system reports it immediately.
• Compliance: All backup activities are logged automatically - audit-ready.

That is exactly what eguide4DATA offers. OT devices are captured centrally, backed up automatically and fully documented - vendor-independent, scalable, for single plants or group structures.

And the best part: the switch from USB stick chaos to a structured system is less effort than most people fear. It often starts with a pilot project - three to five critical machines, measurable results, then gradual expansion.

One last thought

The USB stick in the second drawer on the left has probably not caused any problem so far. That is no proof that it never will. It is merely proof that the worst case has not occurred yet.

See eguide4DATA in action without obligation?

In a personal demo, we show you how eguide4DATA secures your OT infrastructure -
tailored to your machinery and your requirements.