EN 1090
EU harmonized standard for steel and aluminium structures execution
FedRAMP
U.S. program standardizing federal cloud security authorizations
Quick Verdict
EN 1090 mandates CE marking for EU structural steel/aluminium via FPC and execution classes, enabling market access. FedRAMP standardizes US federal cloud security through NIST baselines and 3PAO assessments for reusable authorizations. Manufacturers adopt EN 1090 for legal compliance; CSPs pursue FedRAMP for government contracts.
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Risk-based Execution Classes (EXC1-EXC4) scaling requirements
- Mandatory certified Factory Production Control (FPC) system
- Enables CE marking under CPR for structural components
- Integrates ISO 3834 welding quality management
- Ensures full material traceability and NDT inspection
FedRAMP
Federal Risk and Authorization Management Program
Key Features
- Reusable authorizations across federal agencies
- NIST SP 800-53 baselines at three impact levels
- Independent 3PAO security assessments required
- Ongoing continuous monitoring with automation
- FedRAMP Marketplace for transparency and reuse
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
EN 1090 Details
What It Is
EN 1090 is a harmonized European standard family (EN 1090-1/-2/-3) for execution of structural steel and aluminium components. It provides a risk-based framework under the Construction Products Regulation (CPR) for fabrication, assembly, and conformity assessment enabling CE marking.
Key Components
- **EN 1090-1Conformity assessment, FPC certification by Notified Body.
- **EN 1090-2/-3Technical rules for steel/aluminium (welding, tolerances, corrosion protection).
- Execution Classes (EXC1-EXC4) scaling requirements.
- Builds on ISO 3834 for welding; certification via AVCP systems with ongoing surveillance.
Why Organizations Use It
- Mandatory for EU market access of load-bearing components.
- Reduces liability, ensures traceability, improves quality.
- Enables bidding on high-risk projects; builds stakeholder trust.
Implementation Overview
Phased: gap analysis, FPC build, welding quals, NB certification. Applies to fabricators in EU/EEA; 6-12 months typical, requires audits/surveillance.
FedRAMP Details
What It Is
FedRAMP (Federal Risk and Authorization Management Program) is a U.S. government-wide standardized framework for security assessment, authorization, and continuous monitoring of cloud services used by federal agencies. Its primary purpose is to enable secure, reusable cloud adoption via NIST SP 800-53 baselines tailored to FIPS 199 impact levels (Low, Moderate, High), reducing duplication across agencies.
Key Components
- **Control baselines~156 (Low), ~323 (Moderate), ~410 (High) controls from NIST SP 800-53 Rev 5, plus LI-SaaS for low-risk SaaS.
- Core artifacts: System Security Plan (SSP), Security Assessment Report (SAR), Plan of Action & Milestones (POA&M).
- Paths: Agency and Program Authorizations via accredited 3PAOs.
- Built on continuous monitoring with automation emphasis (FedRAMP 20x).
Why Organizations Use It
- Mandatory for federal cloud procurement, unlocking contracts.
- Enhances security posture, reuse, and market access.
- Builds trust with agencies, reduces risk, differentiates competitively.
Implementation Overview
- Gap analysis, SSP development, 3PAO assessment, remediation.
- Targets CSPs serving U.S. federal market; high complexity for all sizes.
- No traditional certification; ongoing authorizations via Marketplace listing. (178 words)
Key Differences
| Aspect | EN 1090 | FedRAMP |
|---|---|---|
| Scope | Structural steel/aluminium fabrication & conformity | Cloud service security assessment & monitoring |
| Industry | Construction, EU/EEA manufacturers | US federal cloud providers, government-wide |
| Nature | Harmonized standard, mandatory CE marking | Standardized program, mandatory for federal cloud |
| Testing | FPC certification, notified body audits/surveillance | 3PAO assessments, continuous monitoring reports |
| Penalties | Market exclusion, legal liability | Revocation, contract ineligibility |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about EN 1090 and FedRAMP
EN 1090 FAQ
FedRAMP FAQ
You Might also be Interested in These Articles...
Top 5 Unseen Complexities Modern Compliance Software Effortlessly Manages
Uncover top 5 unseen complexities modern compliance software manages effortlessly—from sensitive data mapping to real-time regulatory shifts. Automate audits, i
NIST 800-53 Private Sector ROI Reality Check: Isolating Control Family Impacts on 2024 Breach Costs
Discover NIST 800-53 ROI in private sector: control families like RA, SI, SR reduce median breach costs from $100K to under $50K. Get benchmarks to prioritize i
TISAX Tabletop Exercises for EV Battery Suppliers: Ransomware Drill Scripts and AAR Templates with 2025 ENX Podcast Breakdown
Practical TISAX tabletop scripts for EV battery suppliers facing 'Very High' ASLP. Download ransomware AAR templates, get 2024 ENX lessons & 2025 podcast on VDA
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
ISO 27032 vs HITRUST CSF
Compare ISO 27032 vs HITRUST CSF: cybersecurity guidelines for Internet threats vs certifiable controls for compliance. Uncover differences, benefits & choose the right framework now.
TOGAF vs SAMA CSF
Compare TOGAF vs SAMA CSF: EA framework for business-IT alignment meets Saudi financial cyber maturity model. Uncover key differences, implementation strategies & governance wins. Optimize now!
NIST 800-53 vs ISO 22000
Discover NIST 800-53 vs ISO 22000: Compare cybersecurity/privacy controls with food safety management. Uncover differences, overlaps, RMF integration & implementation for compliance success.