Overview
CEN ISO/TR 22100-4:2020 (ISO/TR 22100-4:2018) provides guidance for machinery manufacturers on how related IT‑security (cyber security) issues can influence the safety of machinery. Adopted by CEN from ISO, this technical report helps identify and address IT‑security threats that may affect safe machine operation when a machine is put into service or placed on the market for the first time. It is a guidance document - not a specification - and does not cover physical bypass or defeat of risk reduction measures.
Key topics
- Relationship to ISO 12100: Explains how IT‑security considerations fit into the general risk assessment and risk‑reduction framework for machine safety.
- Characterization of safety vs IT‑security: Distinguishes objectives (safety of persons vs confidentiality/integrity/availability) and how these interact.
- Legal and standardization context: Summarizes relevant regulatory considerations and the standards landscape.
- Whole‑life‑cycle approach: Essential steps to consider IT‑security from design, commissioning and operation through maintenance and decommissioning.
- Threat assessment guidance: Generic guidance for assessing IT‑security threats that may influence machine safety (remote access, parameter manipulation, monitoring).
- Roles and responsibilities: Defines stakeholders such as manufacturers, integrators and users and their roles in addressing safety-related IT‑security issues.
- Practical manufacturer guidance: High‑level guidance on component selection (hardware/software), appropriate machine design, and information to include in instruction handbooks.
- Terminology: Definitions for terms like attack, authentication, encryption, firewall, IT‑security incident, integrator, etc.
Applications and users
This report is practical for:
- Machinery manufacturers designing connected or smart equipment
- Safety engineers integrating functional safety and cyber security considerations
- System integrators assembling manufacturing systems and defining safety strategies
- Compliance and product managers preparing technical documentation and market declarations
- Maintenance and support teams developing secure remote-service procedures
Use cases include assessing remote‑service access, protecting safety‑related control systems from unauthorized parameter changes, and incorporating IT‑security into risk‑assessment workflows.
Related standards
- ISO 12100 - General principles for design: risk assessment and risk reduction (primary safety framework referenced)
- ISO/IEC standards on cyber security and IoT (contextual references within the report)
- Other sector or component standards (e.g., safety control and integration standards) are referenced for detailed requirements; this TR provides guidance on where to consider them.
This technical report is best used as a practical bridge between classical machine safety (ISO 12100) and emerging IT‑security risks in smart manufacturing and connected machinery.