FISMA
U.S. federal law mandating risk-based cybersecurity programs
EN 1090
EU standard for steel and aluminium structural execution.
Quick Verdict
FISMA mandates risk-based cybersecurity for US federal systems via NIST RMF, ensuring compliance and resilience. EN 1090 requires CE-marked structural steel/aluminium via FPC, guaranteeing execution quality. Agencies/contractors adopt FISMA for mandates; fabricators use EN 1090 for EU market access.
FISMA
Federal Information Security Modernization Act of 2014
Key Features
- Mandates NIST Risk Management Framework (RMF)
- Requires continuous monitoring and diagnostics
- Enforces risk-based system categorization (FIPS 199)
- Applies to agencies, contractors, and supply chains
- Demands annual IG assessments and OMB reporting
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Risk-based Execution Classes EXC1-4
- Factory Production Control FPC certification
- CE marking via Notified Body audits
- Welding quality management ISO 3834
- Material traceability and NDT inspection
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
FISMA Details
What It Is
Federal Information Security Modernization Act (FISMA) of 2014 is a U.S. federal law establishing a risk-based framework for protecting federal information and systems. It modernizes the 2002 act, emphasizing continuous monitoring, incident reporting, and NIST standards for civilian executive branch agencies and contractors.
Key Components
- NIST RMF 7-step process: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.
- NIST SP 800-53 controls tailored by FIPS 199 impact levels.
- Annual metrics, IG evaluations, OMB/DHS/CISA oversight.
- Compliance via SSPs, POA&Ms, ATOs; no formal certification but independent audits.
Why Organizations Use It
Mandated for federal agencies/contractors handling federal data; reduces breach risks, enables market access, builds resilience. Strategic benefits include operational efficiency and competitive edge in federal procurement.
Implementation Overview
Phased RMF approach: governance/inventory, categorization/control selection, implementation/assessment, continuous monitoring. Applies to all federal sizes/industries; requires automation, training, supply chain oversight. Involves IG annual assessments.
EN 1090 Details
What It Is
EN 1090 is a harmonized European standard family for the execution of steel and aluminium structures. It provides technical requirements and conformity assessment under the EU Construction Products Regulation (CPR), enabling CE marking. Its risk-based approach uses Execution Classes (EXC1–EXC4) to scale requirements based on failure consequences, service conditions, and production complexity.
Key Components
- **EN 1090-1Conformity assessment, Factory Production Control (FPC), Declaration of Performance (DoP).
- **EN 1090-2/-3Technical rules for steel/aluminium (materials, welding, tolerances, corrosion protection, inspection/NDT).
- Core principles: traceability, qualified welding (ISO 3834), risk-scaled controls.
- Certification model: Notified Body audits FPC with ongoing surveillance.
Why Organizations Use It
- Mandatory for CE marking and EU market access for structural components.
- Reduces liability, ensures quality, enables high-risk projects.
- Builds trust, differentiates in tenders, lowers rework via disciplined processes.
Implementation Overview
- Phased: gap analysis, FPC development, personnel training, NB certification (3-12 months).
- Applies to fabricators in construction; requires welding coordinators, digital traceability.
- Involves audits, ITT/ITC, surveillance for manufacturers of load-bearing kits/components.
Key Differences
| Aspect | FISMA | EN 1090 |
|---|---|---|
| Scope | Federal information security and systems | Structural steel/aluminium components execution |
| Industry | US federal agencies, contractors, cloud providers | EU construction, steel/aluminium fabricators |
| Nature | US federal law, mandatory for agencies | EU harmonized standard, mandatory CE marking |
| Testing | Continuous monitoring, RMF assessments, IG audits | FPC certification, NB audits, surveillance |
| Penalties | Contract loss, debarment, IG reports | Market exclusion, fines, certificate suspension |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about FISMA and EN 1090
FISMA FAQ
EN 1090 FAQ
You Might also be Interested in These Articles...
CIS Controls v8.1 Metrics That Matter: KPIs, KRIs, and Dashboards for Board-Ready Cyber Reporting
Quantify CIS Controls v8.1 success with KPIs, KRIs & dashboards. Learn what to measure, calculations, and executive presentations linking security to business r
SOC 2 Audit Survival Guide: First 5 Steps to Ace Your Type 2 Audit with Infographic
Ace your SOC 2 Type 2 audit with the first 5 essential steps: evidence collection, auditor tips, red flags from SignWell's experience. Get checklists & infograp
Decoding Tomorrow's Regulations: How Advanced Compliance Tools Predict and Prepare for Future Shifts
Advanced compliance tools use AI, analytics & real-time monitoring to predict regulatory shifts, cut non-compliance costs 3x, and ensure audit readiness. Stay p
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
COBIT vs NIST 800-53
Compare COBIT vs NIST 800-53: Governance framework meets security controls catalog. Optimize IT risk, compliance & value—tailor your best-fit strategy now!
ISO 9001 vs SOC 2
ISO 9001 vs SOC 2: Global QMS leader (1M+ certs, PDCA focus) vs security trust criteria for services. Uncover key diffs, benefits & choose for compliance success now.
ISO 37301 vs FedRAMP
ISO 37301 vs FedRAMP: Certifiable CMS standard meets US federal cloud security. Uncover key differences, benefits & integration for compliance success now!