Programmable logic controllers are often documented incompletely, which means not all their functions are known. In particular, the information on services, protocols, communication ports, and authorisation management is often incomplete. This complicates the analysis of threats because interfaces, functions, and security-relevant mechanisms can be overlooked. Potential dangers may not be considered as a result. Furthermore, if new vulnerabilities are not documented, an organisation may only be able to respond to them to a limited extent (if at all).