Method for operating a technical system, wherein at least one information element of a first type which relates to the system and is dependent on the respective system state of the system is transmitted in the method from at least one first facility of the system to at least one second facility, wherein the system is an energy distribution or energy supply system, and the first and second facility form components of the energy distribution or energy supply system, and wherein the second facility - uses at least one information element of a second type which originates neither from the first facility nor from a different facility of the system, i.e. comes from a source other than the system, to estimate the system state, - checks, on the basis of the estimated system state, whether the received information matches the estimated system state to a predefined extent, and, - in the event of a match to the predefined extent, regards the information as trusted, and otherwise generates a warning signal indicating a possible data attack, - characterized in that - the information of a second type is at least one of the following information elements: weather data, calendar data, current electricity prices, electricity price forecasts, and in that - at least one other information element of a first type is transmitted from the second facility to the first facility and/or to at least one further facility, and the first or the at least one further facility - uses at least one information element of a second type to estimate the system state, - checks, on the basis of the estimated system state, whether the received other information matches the estimated system state to a predefined extent, and - in the event of a match to the predefined extent, regards the other information of a first type from the second and/or further facility as trusted, and otherwise generates a warning signal indicating a data attack, wherein - the second facility is a field device of the technical system and has, in particular, an adjustment facility (SE1-SE3), and - the information of a first type comprises at least one adjustment command (ST1-ST4) which the second facility is intended to execute, but only when no warning signal is generated. - uses at least one information element of a second type which originates neither from the first facility nor from a different facility of the system, i.e. comes from a source other than the system, to estimate the system state, - checks, on the basis of the estimated system state, whether the received information matches the estimated system state to a predefined extent, and, - in the event of a match to the predefined extent, regards the information as trusted, and otherwise generates a warning signal indicating a possible data attack, - characterized in that - the information of a second type is at least one of the following information elements: weather data, calendar data, current electricity prices, electricity price forecasts, and in that - at least one other information element of a first type is transmitted from the second facility to the first facility and/or to at least one further facility, and the first or the at least one further facility - uses at least one information element of a second type to estimate the system state, - checks, on the basis of the estimated system state, whether the received other information matches the estimated system state to a predefined extent, and - in the event of a match to the predefined extent, regards the other information of a first type from the second and/or further facility as trusted, and otherwise generates a warning signal indicating a data attack, wherein - the second facility is a field device of the technical system and has, in particular, an adjustment facility (SE1-SE3), and - the information of a first type comprises at least one adjustment command (ST1-ST4) which the second facility is intended to execute, but only when no warning signal is generated.