EN 1090 vs CIS Controls
EN 1090
European standard for steel/aluminium structures execution and CE marking
CIS Controls
Prioritized cybersecurity controls framework for cyber resilience.
Quick Verdict
EN 1090 mandates CE marking for EU structural steel/aluminium via FPC certification, ensuring market access. CIS Controls provide voluntary cybersecurity hygiene for all organizations, reducing breach risks through prioritized safeguards.
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Mandates certified Factory Production Control for CE marking
- Risk-based Execution Classes (EXC1-EXC4) scale requirements
- Detailed technical execution rules for steel structures
- Requires welding quality per ISO 3834 integration
- Ensures full material traceability and NDT inspection
CIS Controls
CIS Critical Security Controls v8.1
Key Features
- 18 prioritized controls with 153 actionable safeguards
- Implementation Groups (IG1-IG3) for scalability
- Offense-informed from real attack data
- Mappings to NIST, ISO 27001, PCI DSS
- Free tools like Benchmarks and Navigator
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
EN 1090 Details
What It Is
EN 1090 is a harmonized European standard family (EN 1090-1, -2, -3) for execution and conformity assessment of structural steel and aluminium components under the Construction Products Regulation (CPR). It enables CE marking via a risk-based framework scaling requirements by Execution Classes (EXC1-EXC4).
Key Components
- **EN 1090-1Conformity assessment, Factory Production Control (FPC), Declaration of Performance (DoP).
- **EN 1090-2/-3Technical rules for steel/aluminium (materials, welding, tolerances, corrosion, inspection/NDT).
- Core principles: Traceability, welding per ISO 3834, notified body certification, ongoing surveillance.
Why Organizations Use It
- Mandatory for EU market access with load-bearing components.
- Reduces liability, ensures quality, unlocks high-risk projects.
- Builds trust via certified FPC and traceability; competitive edge in tenders.
Implementation Overview
Phased: Gap analysis, FPC build, personnel training (welding coordinator), ITT/ITC, notified body audits. Applies to fabricators; 6-12 months typical; requires certification and surveillance.
CIS Controls Details
What It Is
CIS Critical Security Controls v8.1 is a community-driven, prescriptive cybersecurity framework of prioritized best practices to reduce attack surfaces and enhance resilience. It applies to all industries and sizes via Implementation Groups (IG1–IG3), focusing on actionable Safeguards derived from real-world threats.
Key Components
- 18 Controls across asset management, access control, vulnerability management, monitoring, and incident response.
- 153 Safeguards grouped into IG1 (56 essentials), IG2, IG3 for scalability.
- Built on offense-informed prioritization; maps to NIST, ISO 27001, PCI DSS.
- No formal certification; self-assessed compliance with tools like Controls Navigator.
Why Organizations Use It
- Mitigates 85% of common attacks, cuts breach costs, accelerates multi-framework compliance.
- Builds trust with insurers, partners; enables Safe Harbor in some U.S. states.
- Delivers ROI via efficiency, reduced MTTR, competitive differentiation.
Implementation Overview
- Phased roadmap: governance, discovery, foundational (IG1 3–9 months), expansion (IG2/3 6–18 months), validation.
- Applies universally; SMBs target IG1, enterprises IG3.
- Involves automation, metrics, cross-functional teams; no mandatory audits.
Key Differences
| Aspect | EN 1090 | CIS Controls |
|---|---|---|
| Scope | Structural steel/aluminium fabrication & conformity | Cybersecurity best practices across IT environments |
| Industry | Construction, manufacturing (EU/EEA focus) | All industries worldwide, technology-agnostic |
| Nature | Harmonized EU standard, mandatory CE marking | Voluntary cybersecurity framework, best practices |
| Testing | FPC certification, notified body audits/surveillance | Self-assessment, implementation groups, no certification |
| Penalties | Market exclusion, legal liability without CE mark | No legal penalties, increased breach risk |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about EN 1090 and CIS Controls
EN 1090 FAQ
CIS Controls FAQ
You Might also be Interested in These Articles...
Beyond Reactive: Transforming Compliance into Real-Time Threat Prevention
Discover how modern compliance monitoring tools leverage continuous, real-time oversight and automated alerts to shift organizations from reactive problem-solving to proactive threat detection and prevention, safeguarding against emerging risks before they escalate.
Thailand PDPA Enforcement Trends 2025: Analyzing 1,048 Complaints, Breach Volumes, and Hidden Lessons for Proactive Compliance
Decode PDPC Thailand's 1,048 complaints & 610 breaches. Uncover consent/security violations, project 2025 enforcement. Risk heatmap, self-assessment & playbook
Top 10 NIST CSF 2.0 Myths Busted: Separating Hype from Reality for Smarter Adoption
Bust 10 NIST CSF 2.0 myths like 'only for critical infrastructure' or 'Govern replaces Identify'. Plain-English breakdowns, evidence, and fixes for flexible ris
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Explore More Comparisons
See how EN 1090 and CIS Controls compare against other standards