Device (newCPPE) for use in a network (CPPS), in particular a production network, comprising at least one existing device (CPPE_1, CPPE_2) and wherein at least one virtual sub-network (IS, SMS, NMS, RS, NSMBS, DS, PS) is established within the network (CPPS) and a certain trust level is assigned to this at least one virtual sub-network (IS, SMS, NMS, RS, NSMBS, DS, PS), the device (newCPPE) being arranged in that - the device (newCPPE) is assigned a first trust level, - the device (newCPPE) receives a token correlated with the assigned first trust level, - the device (newCPPE) is permitted into the at least one virtual sub-network (IS, SMS, NMS, RS, NSMBS, DS, PS) upon presentation of that token if the first trust level corresponds or comprises the certain trust level,, wherein - the certain trust level corresponds to at least one security requirement for entering the virtual sub-network (IS, SMS, NMS, RS, NSMBS, DS, PS) or/and corresponds to at least one capability required in the virtual sub-network (IS, SMS, NMS, RS, NSMBS, DS, PS) or/and - the first trust level corresponds to rights assigned to the device (newCPPE), the assignment depending on at least one of - a type of the device (newCPPE), in particular as revealed by an identity certificate (1.3,2.9), - a status of an integration of the device (newCPPE) into the network (CPPS), in particular if access to at least one virtual sub-network (IS, SMS, NMS, RS, NSMBS, DS, PS) has already been granted or to which of the at least one virtual sub-networks (IS, SMS, NMS, RS, NSMBS, DS, PS) within the network (CPPS) access has been granted, - a previous accessing process by the device (newCPPE), - at least one capability (4.8) of the device (newCPPE), - a geographic position of the device (newCPPE) - a security parameter of the device (newCPPE), in particular a used encryption method. - the device (newCPPE) is assigned a first trust level, - the device (newCPPE) receives a token correlated with the assigned first trust level, - the device (newCPPE) is permitted into the at least one virtual sub-network (IS, SMS, NMS, RS, NSMBS, DS, PS) upon presentation of that token if the first trust level corresponds or comprises the certain trust level,, wherein - the certain trust level corresponds to at least one security requirement for entering the virtual sub-network (IS, SMS, NMS, RS, NSMBS, DS, PS) or/and corresponds to at least one capability required in the virtual sub-network (IS, SMS, NMS, RS, NSMBS, DS, PS) or/and - the first trust level corresponds to rights assigned to the device (newCPPE), the assignment depending on at least one of - a type of the device (newCPPE), in particular as revealed by an identity certificate (1.3,2.9), - a status of an integration of the device (newCPPE) into the network (CPPS), in particular if access to at least one virtual sub-network (IS, SMS, NMS, RS, NSMBS, DS, PS) has already been granted or to which of the at least one virtual sub-networks (IS, SMS, NMS, RS, NSMBS, DS, PS) within the network (CPPS) access has been granted, - a previous accessing process by the device (newCPPE), - at least one capability (4.8) of the device (newCPPE), - a geographic position of the device (newCPPE) - a security parameter of the device (newCPPE), in particular a used encryption method. - a type of the device (newCPPE), in particular as revealed by an identity certificate (1.3,2.9), - a status of an integration of the device (newCPPE) into the network (CPPS), in particular if access to at least one virtual sub-network (IS, SMS, NMS, RS, NSMBS, DS, PS) has already been granted or to which of the at least one virtual sub-networks (IS, SMS, NMS, RS, NSMBS, DS, PS) within the network (CPPS) access has been granted, - a previous accessing process by the device (newCPPE), - at least one capability (4.8) of the device (newCPPE), - a geographic position of the device (newCPPE) - a security parameter of the device (newCPPE), in particular a used encryption method.