EN 1090 vs ISO 28000
EN 1090
European standard for structural steel/aluminium execution and CE marking
ISO 28000
International standard for supply chain security management systems.
Quick Verdict
EN 1090 mandates CE marking for structural steel/aluminium via FPC and execution classes for EU construction market access. ISO 28000 provides voluntary security management for global supply chains. Fabricators choose EN 1090 for legal compliance; logistics firms adopt ISO 28000 for resilience.
EN 1090
Execution of steel and aluminium structures
Key Features
- Risk-based Execution Classes (EXC1-EXC4) scaling requirements
- Mandatory Factory Production Control (FPC) certification
- Enables CE marking for EU market access
- Comprehensive welding quality via ISO 3834 alignment
- Full material traceability and NDT inspection regimes
ISO 28000
ISO 28000:2022 Security Management Systems Requirements
Key Features
- Risk-based supply chain security management framework
- PDCA cycle for continual improvement and resilience
- Scalable to all organization sizes and industries
- Integrates with ISO 9001, 22301, 27001 standards
- Supplier and third-party security governance controls
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
EN 1090 Details
What It Is
EN 1090 is a harmonized European standard family (EN 1090-1/2/3) for execution of steel and aluminium structural components. It provides a risk-based framework under the Construction Products Regulation (CPR) enabling CE marking for load-bearing components in construction works. Primary scope covers fabrication, assembly, and conformity assessment.
Key Components
- **EN 1090-1Conformity assessment, Factory Production Control (FPC), Declaration of Performance (DoP).
- **EN 1090-2/3Technical rules for steel/aluminium (welding, tolerances, corrosion protection, NDT).
- Execution Classes (EXC1-4) based on consequence, service, production categories.
- Certification via Notified Body audits and ongoing surveillance.
Why Organizations Use It
- Mandatory for EU market access and CE marking.
- Reduces liability, ensures traceability, minimizes rework.
- Builds trust with clients, enables high-risk projects.
Implementation Overview
Phased approach: gap analysis, FPC development, welding qualification, NB certification. Applies to fabricators globally targeting EEA; 3-12 months typical, high complexity for EXC3/4.
ISO 28000 Details
What It Is
ISO 28000:2022 is an international management system standard specifying requirements for establishing, implementing, maintaining, and improving a security management system (SMS) focused on supply chain security and resilience. It uses a risk-based, PDCA (Plan-Do-Check-Act) approach to protect people, assets, goods, infrastructure, and information.
Key Components
- Core clauses: context, leadership, planning, support, operation, performance evaluation, improvement.
- Emphasizes risk assessment, security strategies, incident response, supplier controls.
- Aligned with ISO High Level Structure for integration with ISO 9001, 22301, 27001.
- Optional certification via accredited bodies per ISO/IEC TS 17021-8.
Why Organizations Use It
- Reduces supply chain disruptions, theft, sabotage risks.
- Meets contractual, regulatory drivers (e.g., C-TPAT equivalents).
- Lowers insurance costs, enables trade facilitation.
- Builds stakeholder trust, competitive edge in logistics, manufacturing.
Implementation Overview
- Phased: scoping, gap analysis, risk treatment, deployment, audit, certification.
- Scalable for SMEs to multinationals across industries.
- Involves mapping, training, KPIs, continual improvement.
Key Differences
| Aspect | EN 1090 | ISO 28000 |
|---|---|---|
| Scope | Execution and conformity of steel/aluminium structures | Supply chain security management system |
| Industry | Construction, steel/aluminium fabrication (EU/EEA) | Logistics, manufacturing, all supply chains (global) |
| Nature | Harmonized standard, mandatory CE marking (CPR) | Voluntary management system standard |
| Testing | FPC certification, ITT/ITC, notified body surveillance | Internal audits, management review, optional certification |
| Penalties | Market exclusion, legal liability without CE mark | No legal penalties, loss of certification/trust |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about EN 1090 and ISO 28000
EN 1090 FAQ
ISO 28000 FAQ
You Might also be Interested in These Articles...
Thailand PDPA Enforcement Trends 2025: Analyzing 1,048 Complaints, Breach Volumes, and Hidden Lessons for Proactive Compliance
Decode PDPC Thailand's 1,048 complaints & 610 breaches. Uncover consent/security violations, project 2025 enforcement. Risk heatmap, self-assessment & playbook
The CIS Controls v8.1 Evidence Pack: What Auditors Ask For (and How to Produce Proof Fast)
Fail CIS Controls v8.1 audits due to missing evidence? Get the blueprint: exact artifacts auditors want, repository structure, and automation from security tool
The Reasons Why NIS2 is Fundamental for Cyber Resilience in Europe
Uncover why NIS2 transcends compliance burdens, delivering real cyber resilience value through enforced measurements and activities. Explore insights via our pa
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Explore More Comparisons
See how EN 1090 and ISO 28000 compare against other standards