Machinery cybersecurity risk assessment
Sytance · Updated
Machinery cybersecurity risk assessment is part of machinery safety risk assessment when corruption can create a hazardous situation or weaken a protective measure. The analysis should start from the machine, its intended use, reasonably foreseeable misuse, hazards, and safety-related control functions.
The prEN 50742 references in this article use the December 2025 enquiry draft: Introduction and clause 4.3. These are draft provisions for technical planning, not requirements of a published European Standard.
Cybersecurity within the safety risk assessment
determine the limits of the machinery or related product, which include the intended use and any reasonably foreseeable misuse thereof
Regulation (EU) 2023/1230, Annex III Part B — English original
Annex III Part B requires the manufacturer to determine applicable essential health and safety requirements and design the machinery or related product to eliminate hazards or minimise relevant risks. ISO 12100 follows the same sequence: determine limits, identify hazards and hazardous situations, estimate and evaluate risk, then reduce it.
Cybersecurity work should enter that sequence at the point at which a corruptible connection, software item, data item, configuration, or control path can affect the hazard or the protective measure.
How corruption can cause harm
For each safety function or protective measure, the assessment examines how corruption could prevent it from working. This connects the threat to a specific hazardous situation.
Safety function first
Name the safety function, safe state, limit, interlock, stop behaviour, mode, or protective measure that prevents harm.
Interface second
Identify the interface or path that can change software, data, configuration, commands, or process information used by that safety function.
Corruption effect third
Explain how accidental or intentional corruption could create a new hazard, increase risk, or defeat the intended risk reduction.
Protection last
Select protective measures that reduce the safety risk without weakening the functional safety of the machinery.
Threats that affect functional safety
prEN 50742 treats threat assessment as an addition to the machinery risk assessment, not a replacement for it. The draft explains that vulnerabilities can compromise protective measures. It assesses the resulting risk through the effect on functional safety.
That distinction is useful even while prEN 50742 remains a draft. A network scan result, missing password policy, or exposed service is not enough by itself. The machinery file needs the path from that weakness to a hazardous situation or a safety-related control effect.
Documenting the assessment
ISO 12100 expects risk-assessment documentation to show the machinery assessed, assumptions, hazards and hazardous situations, information used, risk-reduction objectives, protective measures, residual risks, and the result of the assessment. For cybersecurity, those records should also make the corruption path visible.
- the product, configuration, software version, and intended use assessed;
- the safety function or protective measure affected by corruption;
- the interface, access path, update path, or data path that can cause the corruption;
- the safety effect if the corruption occurs;
- the protective measure, countermeasure, or information for use relied on;
- the residual risk and any limits of the selected protection.
Risk assessment in the technical documentation
Article 10 requires manufacturers to draw up the technical documentation before placing machinery or a related product on the market or putting it into service. Annex IV requires documentation on the risk assessment, including applicable essential health and safety requirements and the protective measures used to meet them.
Source code and programming logic
Under Article 10(3), where relevant, source code or programming logic included in the technical documentation must be made available to competent national authorities upon a reasoned request, if it is necessary for them to check compliance with Annex III.