EN 1090
European standards for steel and aluminium structures execution
ISO 27017
International code of practice for cloud security controls
Quick Verdict
EN 1090 mandates CE marking and FPC for structural metal fabrication in EU construction, while ISO 27017 provides voluntary cloud security guidance extending ISO 27001. Fabricators adopt EN 1090 for market access; CSPs use ISO 27017 for trust and compliance.
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Risk-based Execution Classes (EXC1-EXC4) scaling requirements
- Factory Production Control (FPC) with Notified Body certification
- Enables mandatory CE marking for structural components
- Integrates ISO 3834 for welding quality management
- Full traceability of materials, processes, and inspections
ISO 27017
ISO/IEC 27017:2015 Code of practice for cloud controls
Key Features
- Clarifies shared responsibilities between CSPs and CSCs
- Adds 7 cloud-specific controls for multi-tenancy risks
- Provides guidance on 37 ISO 27002 controls for cloud
- Addresses VM hardening and segregation in virtual environments
- Enables customer monitoring of cloud service activities
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
EN 1090 Details
What It Is
EN 1090 is a harmonized European standard family (EN 1090-1/2/3) for execution and conformity assessment of structural steel and aluminium components. It implements the EU Construction Products Regulation (CPR), enabling CE marking. Primary scope covers fabrication, assembly, and placement on the EEA market. Key approach is risk-based via Execution Classes (EXC1-EXC4) linking consequence, service, and production categories to stringent requirements.
Key Components
- **EN 1090-1Conformity assessment, Factory Production Control (FPC), Declaration of Performance (DoP).
- **EN 1090-2/3Technical rules for steel/aluminium (materials, welding, tolerances, corrosion, NDT).
- Integrates ISO 3834 for welding; risk-scaled inspection/traceability.
- **Certification modelNotified Body audits FPC, initial inspection, ongoing surveillance.
Why Organizations Use It
Mandatory for market access in EU/EEA; reduces liability, ensures safety. Drives traceability, quality consistency, rework reduction. Builds stakeholder trust via CE marking; enables high-risk projects (EXC3/4).
Implementation Overview
Phased: gap analysis, FPC build, welding quals, NB certification (3-12 months). Applies to fabricators globally targeting Europe; suits SMEs to enterprises with welding focus.
ISO 27017 Details
What It Is
ISO/IEC 27017:2015 is a code of practice extending ISO/IEC 27002 with cloud-specific guidance for information security controls. It targets cloud services across IaaS, PaaS, and SaaS in public, private, or hybrid models. Its risk-based approach adapts general controls to cloud risks like multi-tenancy and shared responsibilities between cloud service providers (CSPs) and customers (CSCs).
Key Components
- Guidance on 37 ISO/IEC 27002 controls plus 7 new cloud-specific CLD controls (e.g., shared roles, VM segregation, asset removal).
- Covers 14 domains mirroring ISO 27002 (e.g., access control, operations security).
- Built on ISO 27001 ISMS; no standalone certification—integrated into ISO 27001 audits.
Why Organizations Use It
- Meets procurement demands and regulatory alignment (e.g., GDPR support via ISO 27018 pairing).
- Clarifies shared responsibility, reducing cloud incident risks (e.g., misconfigurations).
- Builds trust, differentiates CSPs, and enables competitive SLAs.
Implementation Overview
- Extend existing ISO 27001 ISMS via risk assessment, control mapping, and cloud configurations.
- Key activities: shared responsibility matrices, VM hardening, logging enablement.
- Suits CSPs, CSCs of all sizes globally; audited jointly with ISO 27001 (9-12 months typical).
Key Differences
| Aspect | EN 1090 | ISO 27017 |
|---|---|---|
| Scope | Structural steel/aluminium fabrication and CE marking | Cloud-specific information security controls |
| Industry | Construction, fabrication (EU/EEA) | Cloud services, IT (global) |
| Nature | Harmonized standard under CPR, mandatory CE | Voluntary guidance extending ISO 27001/27002 |
| Testing | FPC certification, notified body audits/surveillance | Integrated into ISO 27001 audits, no standalone cert |
| Penalties | Market exclusion, legal liability without CE | No legal penalties, loss of audit scope conformity |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about EN 1090 and ISO 27017
EN 1090 FAQ
ISO 27017 FAQ
You Might also be Interested in These Articles...
5 Ways Modern Compliance Software Makes Evolving Regulations Your Strategic Advantage
Discover 5 ways modern compliance software turns evolving regulations into strategic advantage. Automate monitoring, cut 3x non-compliance costs, stay audit-rea
The Human-AI Synergy: How Modern Compliance Tools Amplify Your Team's Strategic Impact
Unlock human-AI synergy with modern compliance tools. Automate monitoring, cut non-compliance risks 3x, and boost strategic decision-making. Elevate your team's
Real-World ISO 27701 Success: Synthesized Case Studies, Metrics, and Lessons for Privacy Resilience
Real-world ISO 27701 success from Tribeca, Kocho: DSAR efficiency gains, risk score reductions, certification ROI. Synthesized metrics prove privacy resilience
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
NIST CSF vs OSHA
Compare NIST CSF vs OSHA: Uncover key differences in cybersecurity frameworks and workplace safety standards. Optimize risk management, ensure compliance—read now to protect your organization!
ISO 37301 vs NIST 800-53
Compare ISO 37301 vs NIST 800-53: Certifiable CMS meets federal security controls. Uncover key differences, alignments & integration for risk-based compliance. Optimize now!
CE Marking vs NERC CIP
Discover CE Marking vs NERC CIP: EU product safety certification meets US grid cybersecurity standards. Unlock key differences, compliance strategies & expert insights for global ops.