BSI-CS 154: When control systems are connected to the internet – protection, insurance and your obligations
Refrigerated counters, melting furnaces, milking robots, heating systems: more and more technology in businesses is controlled and maintained via the internet. After the attacks on supermarket refrigeration systems across Europe, the BSI (German Federal Office for Information Security) has published its own recommendation: BSI-CS 154. Here you will find out what it says, which businesses are affected – and why cyber insurance alone is not enough if you do not know your obligations.
Key points at a glance
- BSI-CS 154 is titled “Gefährdung durch internet-verbundene OT-Systeme” (Threats from internet-connected OT systems) and was published on 13 October 2026, immediately after the attacks on supermarkets in France.
- OT stands for Operational Technology: the control systems of plants and machines – not office IT.
- Four core measures: no direct connection to the internet, remote access only via VPN with multi-factor login, install updates, security as routine.
- Insurance: A cyber policy mainly pays for financial losses. Property damage and spoilage of goods are often excluded or limited.
- Your obligation: As the policyholder, you must fulfil the security obligations (Obliegenheiten) – even if a service provider maintains the system.
What is BSI-CS 154?
The Bundesamt für Sicherheit in der Informationstechnik (BSI, German Federal Office for Information Security) publishes cyber security recommendations under the abbreviation “BSI-CS”. Number 154 is titled “Gefährdung durch internet-verbundene OT-Systeme” (Threats from internet-connected OT systems) and has been available via the Allianz für Cyber-Sicherheit since 13 October 2026. It was prompted by the attack on the refrigeration systems of hundreds of French supermarkets on the night of 12 October. Shortly afterwards, cases followed in other European countries, including Germany – more on this in our article Hackers heat up freezers.
According to the BSI, the recommendation is aimed at operators of small industrial or comparable facilities that use industrial control devices – for example for refrigerating food, generating electricity or treating water. So it is specifically not only about large industrial groups, but about supermarkets, trade businesses, farmers, municipal utilities or operators of solar installations.
Why exposed control systems are so dangerous
Many control systems are built for on-site operation and were never intended to be connected directly to the internet. Nevertheless, they are often made openly accessible so that maintenance companies can conveniently access them remotely – sometimes with outdated firmware, default or shared passwords and without a second login factor. Automated scanning programs find such devices quickly. According to press reports, the attacks on supermarkets affected, among others, refrigeration controllers from the manufacturers Danfoss, Copeland and Dixell; in October, the security provider Forescout counted almost 13,000 refrigeration management systems reachable from the internet in 99 countries.
The consequences go far beyond data loss: goods spoil, machines stand still, semi-finished products become unusable, and in the worst case property damage or personal injury occurs.
The four core measures of the recommendation
- No direct internet access: Control systems must not be openly reachable from the internet. Disable port forwarding in the router and do not expose industrial protocols (e.g. Modbus-TCP, S7Comm, Profinet) to the outside.
- Secured remote access only: Remote maintenance exclusively via an encrypted VPN with multi-factor authentication.
- Update and check: Update systems and firmware promptly and regularly check whether devices are reachable from outside.
- Routine instead of a one-off: Build security measures and checks firmly into your operating procedures.
Our additions for practice: Replace default passwords and create a separate account for each access, separate the control network from office IT, set up a separate alarm (e.g. temperature via SMS) and define an emergency plan: who is informed at night, who is allowed to shut down?
You can find the full recommendation at the BSI: BSI-CS 154 at the Allianz für Cyber-Sicherheit.
30 trades with increased risk
Any business whose systems are controlled or maintained via the internet can be affected. The consequences are particularly serious where goods spoil, production comes to a standstill or people are being cared for. Our assessment – in no particular order, sorted by sector:
Retail & food
- Supermarkets and food retail
- Food production
- Butchers and meat processing
- Bakeries and patisseries
- Dairies and cheese makers
- Breweries and beverage producers
Hospitality & logistics
- Restaurants, commercial kitchens and canteens
- Hotels
- Catering
- Cold stores and cold-chain logistics
- Haulage companies with refrigerated vehicles
Healthcare
- Pharmacies
- Medical practices with vaccine and medicine refrigeration
- Hospitals, rehabilitation and care facilities (building services)
- Laboratories and biotech
Production & industry
- Pharmaceutical and chemical production
- Plastics processing (e.g. injection moulding)
- Metalworking and foundries (e.g. melting furnaces)
- Woodworking and joineries (CNC, drying)
- Mechanical and plant engineering
- Printing companies
Agriculture
- Dairy farms (milking robots, milk cooling, barn climate)
- Greenhouses and horticulture (climate control)
- Fish farming and aquaculture
Energy, water & buildings
- Drinking water and wastewater utilities
- Operators of photovoltaic systems (inverters)
- Wind power, biogas and combined heat and power plants
- Housing industry and property management (heating, building management systems)
- Swimming pools, sports and leisure facilities
- Data centres and server rooms (air conditioning)
According to experts, the entire manufacturing sector is also considered at risk: if a melting furnace gets out of sync or a drying system fails, the batch becomes unusable.
What insurance pays – and what it doesn’t
“A cyber insurance policy is classically a financial loss insurance,” says Jan Meurer of the cyber insurer Stoïk to AssCompact. In practice, this means:
| Loss | Typically covered by | What to look out for |
|---|---|---|
| IT forensics, immediate assistance, data recovery | Cyber insurance | Does the cover also apply to control systems, not just office IT? |
| Loss of income / business interruption | Cyber insurance (optional depending on tariff) | Indemnity period, time deductible, compensation limit |
| Damaged hardware | Cyber insurance, often IT hardware only | Some terms and conditions expressly exclude means of production |
| Spoiled goods, business contents, machinery | Contents, refrigerated goods, machinery or electronics insurance | Cyber exclusion in the property policy? Spoilage clause or property damage inclusion in the cyber policy? |
| Third-party claims | Cyber liability, business liability | Who is liable if customers or partners suffer damage? |
What this looks like in a specific set of terms and conditions – with a spoilage clause, a module for physical damage to property (Sachsubstanzschäden) and the question of whether cyber or property insurance pays first – is shown in our follow-up using Stoïk as an example. Terms and conditions differ considerably from insurer to insurer – we clarify for you in each individual case what your policy covers.
Your obligations as a policyholder
A cyber insurance policy requires you to comply with an agreed security standard. These so-called obligations (Obliegenheiten) are set out in the terms and conditions and vary from insurer to insurer. Typical ones are:
- Install security updates promptly – some terms and conditions set fixed deadlines for this.
- Operate outdated systems without updates only in isolation, i.e. without direct internet access.
- Individual access accounts with secure passwords, additional protection (e.g. two-factor login) for remote access.
- Data backups regularly and protected – with Stoïk, for example, at least weekly, retained for two weeks, offline or immutable.
- Comply with statutory, regulatory and contractual security requirements.
If you breach an obligation through gross negligence, you risk a reduction in benefits, and with intent even losing them completely. At least as important are the details in the application: anyone who confirms there, for example, that all systems are up to date without having checked risks the contract being rescinded. The OLG Schleswig (16 U 63/24) thus upheld the rescission of a cyber policy because questions about the security status had been answered “at random” (ins Blaue hinein). Conversely, according to a ruling by the LG Tübingen (May 2023), an insurer had to pay despite outdated servers because the vulnerabilities had not caused the damage. The examples show: it depends on the individual case and the exact wording.
Very important: The obligations (Obliegenheiten) apply to you as the policyholder – even if an external service provider maintains your refrigeration, heating or machinery. You can hand over the tasks, but not the responsibility towards the insurer.
Holding your service provider accountable
Because you remain responsible towards the insurer, the security requirements should be included in the maintenance and service contract. Without an explicit provision, a service provider will, in case of doubt, only owe what has been agreed. These points belong in it:
- Remote access: only via VPN with multi-factor login, no open ports, no permanently active access.
- Login credentials: no default or shared passwords, personal accounts for each technician, deactivation when staff change.
- Updates: obligation to install security updates and firmware within fixed deadlines, and obligation to notify you when a device no longer receives updates.
- State of the art: alignment with recognised recommendations such as BSI-CS 154.
- Reporting obligation: immediate notification of security incidents or known vulnerabilities.
- Logging: traceability of who accessed remotely and when.
- Emergency contact: availability and response times in the event of a fault, including at night and at weekends.
- Liability and insurance: clear liability provisions and proof of adequate professional or IT liability insurance held by the service provider.
- Data protection: a data processing agreement if the service provider has access to personal data.
If the service provider culpably causes the damage, they may be liable for compensation – and an insurer that settles the claim can take recourse against them. The clearer the contract, the better your position. For the legal drafting of the contract, please consult a lawyer.
Your roadmap in five steps
- Create a list of all networked systems and check which ones are reachable from outside.
- Implement the four measures from BSI-CS 154 with your IT team or maintenance service provider.
- Add the security obligations to maintenance and service contracts.
- Compare your cyber and property insurance side by side: property damage, spoilage of goods, business interruption, obligations.
- Check the details in your insurance application against your IT – and update them when things change.
Our offer: We review how your cyber, contents and refrigerated goods insurance work together and show you where gaps arise – for example with Stoïk’s cyber insurance. What its terms and conditions specifically cover is explained in our follow-up using Stoïk as an example. More on this: Cyber security for businesses.
Frequently asked questions
What is BSI-CS 154?
BSI-CS 154 is a cyber security recommendation issued by the German Federal Office for Information Security entitled “Gefährdung durch internet-verbundene OT-Systeme” (Threats from internet-connected OT systems), published on 13 October 2026. It is aimed at operators of small industrial or comparable facilities with control devices, for example for refrigerating food, generating electricity or treating water.
Does my cyber insurance pay if a machine or goods are damaged?
Often not in full. Cyber insurance is primarily financial loss insurance. Property damage such as spoiled goods or damaged means of production is frequently excluded or only covered to a limited extent. At the same time, many property insurance policies exclude cyber attacks. We review how your contracts work together.
Can I hand over IT security to my service provider?
The tasks yes, the responsibility towards the insurer no. The obligations under your policy apply to you as the policyholder. That is why clear security obligations belong in the maintenance and service contract with your service provider.
What happens if the details in my insurance application are incorrect?
Depending on the case, the insurer can then withdraw from the contract, rescind it or reduce the benefit. Courts have classified answers about the IT security status given “at random” (ins Blaue hinein) as fraudulent. So have your IT check the details before you take out the policy.
Warm regards from KiS
Note: General information, as of 05.11.2026, not legal advice and not individual advice. The list of trades is our assessment, not an official classification. The terms and conditions of the respective insurer are authoritative. Sources: BSI-CS 154 (13.10.2026); reports by dpa, ad-hoc-news, VWheute and AssCompact (October/November 2026); Stoïk, terms and conditions Cyber Serenity – Standard (DE2609.2); decisions OLG Schleswig 16 U 63/24 and LG Tübingen of 26.05.2023. KiS – Kontor im Schwarzwald GmbH, insurance broker licensed under § 34d Abs. 1 GewO, Reg.-Nr. D-PS74-61V96-00.