As factories, warehouses, hospitals, utilities, and even offices connect more machines to the internet, cyber-attacks now trigger real-world safety hazards—from robotic arms moving unexpectedly to pumps and valves mis-operating.
At the same time, OSHA has expanded electronic injury-and-illness reporting so more employers must submit case-specific data online each year.
This guide brings both sides together: the cyber-physical risks you need to manage and the digital reporting obligations that apply in 2025 and beyond.
What “cyber-physical safety” means for OSHA-regulated workplaces
Operational Technology (OT) and Industrial Control Systems (ICS) bridge the digital and physical worlds. When an attacker or malfunction affects OT/ICS, people can get hurt—not just data.
NIST’s OT security guide explains that OT devices directly monitor or change physical processes, so failures can have immediate safety consequences.
OSHA’s own Technical Manual on Industrial Robot Systems underscores that a robot “system” includes not just the manipulator, but controllers, sensors, programs, power sources, and communications—exactly the elements that can be compromised if security is weak.
That makes robot safety a cyber-physical problem, not just a guarding problem.
CISA’s 2025 OT guidance is blunt: remove OT from the public internet, change default passwords, secure remote access, and segment IT/OT networks to reduce exploitation.
The agency continues to issue ICS advisories because vulnerabilities in real equipment are routinely discovered and sometimes exploited.
Why this matters now
- OT threats are active. CISA keeps publishing ICS advisories throughout 2025, reflecting ongoing vulnerabilities across vendors and sectors.
- OSHA is watching outcomes. If a cyber event causes a recordable injury or hospitalization, it becomes a recordkeeping and reporting issue—not just an IT issue. (See reporting rules below.
- Penalties increased in 2025. OSHA’s maximum penalties rose in January 2025 to $16,550 per serious/other-than-serious violation and $165,514 for willful/repeat violations, adjusted annually for inflation.
Your OSHA digital reporting obligations (2025 snapshot)
OSHA’s Improve Tracking of Workplace Injuries and Illnesses rule requires certain establishments to submit data electronically through the Injury Tracking Application (ITA) each year.
The deadline for timely submission of the prior year’s data is March 2 (e.g., 2024 data were due March 2, 2025; 2025 data are due March 2, 2026).
Who must submit & what to submit
- 100+ employees in designated industries (see Appendix B) must submit case-specific data from Forms 300 and 301, plus summary 300A.
- 20–249 employees in designated industries (Appendix A to Subpart E) must submit Form 300A summary only.
- 250+ employees in industries required to keep records must submit Form 300A summary annually.
How to submit: via the ITA webform, CSV upload, or API—OSHA does not accept emailed forms.
What identifiers are required: establishments must provide their legal company name and Employer Identification Number (EIN) with electronic submissions.
State-plan states: most private-sector employers in state plans have the same submission requirements and still use OSHA’s ITA.
Severe injury/fatality reporting (not the same as ITA)
All employers must notify OSHA when an employee is killed (within 8 hours) or suffers a work-related inpatient hospitalization, amputation, or loss of an eye (within 24 hours)—online or by phone.
(You must report a fatality only if it occurs within 30 days of the incident; inpatient hospitalization/amputation/eye loss only if within 24 hours of the incident.)
Recordkeeping & posting basics (still required)
- Maintain Forms 300, 300A, 301 for 5 years at the worksite.
- Post the 300A summary Feb 1–Apr 30 each year in a conspicuous location, even if you had zero recordables.
At-a-glance: OSHA digital reporting & recordkeeping (2025)
| Obligation | Who it applies to | What to submit/post | Where/How | Due date / window |
|---|---|---|---|---|
| Electronic submission (300 & 301 case data + 300A) | 100+ employees in designated industries (Appendix B) | Forms 300 & 301 case-level data, plus 300A | ITA via webform/CSV/API | March 2 each year (prior year’s data) |
| Electronic submission (300A summary) | 20–249 employees in designated industries (Appendix A) | Form 300A | ITA via webform/CSV/API | March 2 each year |
| Electronic submission (300A summary) | 250+ employees (if required to keep records) | Form 300A | ITA via webform/CSV/API | March 2 each year |
| Post 300A at worksite | Most employers with >10 employees (unless partially exempt) | Form 300A posted (not the log) | Physical posting in a visible place | Feb 1 – Apr 30 |
| Report a fatality | All employers | Fatality notice | Online/phone to OSHA | Within 8 hours |
| Report inpatient hospitalization, amputation, loss of an eye | All employers | Severe-injury notice | Online/phone to OSHA | Within 24 hours |
Note: When you submit electronically, you must include the establishment’s legal name and EIN, and you cannot email completed forms—use the ITA only.
State-plan employers generally submit through the Federal ITA. (Details and definitions in the sections below.)
Privacy & publication: what OSHA collects—and what it doesn’t
OSHA’s final rule says the agency will not collect personally identifying fields like employee names/addresses, health-care provider names, or treatment facility names/addresses from Forms 300/301, and is taking extra steps to prevent release of PII when publishing data.
OSHA does collect the legal company name (and requires the EIN) to improve data quality.
Penalties for getting it wrong (2025)
As of Jan 15, 2025, maximum OSHA penalties are $16,550 per serious/other-than-serious/posting violation, $16,550/day for failure to abate, and $165,514 per willful/repeat violation. OSHA updates these amounts annually for inflation.
Turning cyber-physical risk into a safety program (that also satisfies OSHA)
Tie your information security and EHS teams together. Use these 10 practical controls—each mapped to a safety expectation that an OSHA compliance officer (or your insurer) will recognize:
- Segment IT and OT networks; remove public internet access to PLCs/robot controllers and require a controlled gateway for remote work. (CISA’s 2025 OT mitigations).
- Change default credentials on all OT/IoT devices; implement strong authentication for remote access (e.g., VPN + MFA).
- Lockout/Tagout (LOTO) still rules the day. Ensure your 1910.147 energy-control procedures cannot be bypassed by software/network commands and that servicing procedures address unexpected energization from connected control systems.
- Robot safety by design. Apply machine guarding, safe-speed/space limits, and emergency stops and secure the controller/programming interfaces per OSHA’s robot systems guidance.
- Change management for code/config. Treat ladder logic, robot programs, and HMI set-points like critical assets; review and sign off changes with EHS + engineering. (Aligned to NIST OT guidance.)
- Patch & vulnerability management for OT with a maintenance window model (test offline first). Track ICS advisories relevant to your vendors.
- Alarm management & physical interlocks. Assume software can fail—back up with physical interlocks, guards, and fail-safe states. (Core OSHA expectation; supported by robot/LOTO guidance.)
- Incident playbooks that include OSHA steps. If a cyber event causes an injury, follow your first-aid/medical protocols, then ensure recording on Form 300/301 and reporting within 8/24 hours if thresholds are met.
- Training & drills for operators, not just IT. Teach line workers to recognize abnormal machine behavior and how to hit E-Stops / follow LOTO when in doubt. (OSHA core training expectation.)
- Data quality readiness for ITA. Assign an owner, standardize NAICS assignments per establishment, collect EINs, and prepare CSV/API flows so March 2 is a non-event. (See ITA User Guide.)
Step-by-step: getting compliant before March 2
- Map your establishments (remember: an establishment is a single physical location) and confirm which ones meet 20–249 designated, 100+ designated, or 250+ thresholds.
- Create or update your ITA account (uses Login.gov) and verify each establishment’s EIN, NAICS, address, and headcount.
- Centralize 300/300A/301 data with quality checks; decide your ITA method (webform/CSV/API).
- Post the 300A on site Feb 1–Apr 30 and keep records for 5 years.
- Verify severe-injury/fatality reporting workflows (8-hour/24-hour rule). Test your online reporting link and phone tree.
- Close cyber-physical gaps using the 10-point control list above (segment OT, harden remote access, LOTO discipline, robot safety).
Cyber threats are now safety threats. When a compromised controller or networked robot behaves unpredictably, workers face immediate physical danger.
That’s why a modern safety program must span machine guarding and LOTO plus OT cybersecurity fundamentals like network segmentation and strong remote access controls.
In parallel, OSHA expects transparent digital reporting: know which establishments must file, gather accurate 300/300A/301 data, include your EIN/legal name, post 300A on time, and hit the March 2 submission deadline.
With the right technical controls and a disciplined reporting cadence, you’ll reduce real-world risk, stay compliant, and show your workers—and OSHA—that safety keeps pace with your technology.
Frequently asked questions
Not a single, standalone cybersecurity rule. But OSHA can cite hazards under existing standards (e.g., 1910.147 Lockout/Tagout) and, when appropriate, the General Duty Clause if a recognized cyber-physical hazard could cause serious harm and feasible abatement exists.
If a cyber incident injures a worker, you must record it (300/301) and possibly report it within 8/24 hours depending on severity.
Establishments with 100+ employees in designated industries must submit case-specific 300 and 301 data (plus 300A) through the ITA by March 2 each year for the prior calendar year. Others may need to submit 300A only (see thresholds above).
OSHA does not collect employee names/addresses, provider names, or treatment facility details from Forms 300/301, and it applies extra protections to minimize the release of PII when publishing data.
You must include your legal company name and EIN in electronic submissions.