IEC 62443
International standard for IACS cybersecurity frameworks
EN 1090
EU standard for steel and aluminium structures execution
Quick Verdict
IEC 62443 secures industrial control systems via risk-based cybersecurity frameworks globally, while EN 1090 mandates CE marking for structural steel/aluminium in EU construction through FPC and execution classes. Companies adopt IEC for OT resilience, EN 1090 for legal market access.
IEC 62443
IEC 62443: Security for industrial automation systems
Key Features
- Risk-based zones and conduits segmentation model
- Security levels SL-T, SL-C, SL-A triad
- Shared responsibility across asset owners, integrators, suppliers
- Seven foundational requirements FR1-FR7 taxonomy
- ISASecure modular certifications for components, systems
EN 1090
EN 1090: Execution of steel and aluminium structures
Key Features
- Risk-based Execution Classes (EXC1-EXC4)
- Certified Factory Production Control (FPC)
- CE marking under CPR for market access
- ISO 3834-aligned welding quality management
- Full material and process traceability
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
IEC 62443 Details
What It Is
IEC 62443 is the ISA/IEC series of consensus-based standards for securing Industrial Automation and Control Systems (IACS). It provides a comprehensive, risk-based framework spanning governance, risk assessment, system architecture, and component requirements tailored to OT environments.
Key Components
- Four groupings: General (-1), Policies (-2), System (-3), Components (-4).
- Seven foundational requirements (FR1-7) like identification, integrity, restricted flows.
- Zones/conduits model and security levels (SL 0-4) with SL-T, SL-C, SL-A.
- ISASecure certifications (SDLA, CSA, SSA) for modular conformance.
Why Organizations Use It
- Mitigates OT-specific risks to safety, availability, production.
- Enables shared responsibility, supply chain assurance.
- Supports regulatory compliance, insurance benefits, procurement standards.
- Builds stakeholder trust via certified maturity levels.
Implementation Overview
- Phased: governance (2-1 CSMS), risk assessment (3-2), controls (3-3/4-2), certification.
- Applies to asset owners, integrators, suppliers across industries.
- Requires OT-aware audits, training; multi-year for full maturity.
EN 1090 Details
What It Is
EN 1090 is the European harmonized standard family (EN 1090-1, -2, -3) for execution and conformity assessment of steel and aluminium structural components. It implements the EU Construction Products Regulation (CPR), enabling CE marking. Primary purpose: ensure safe fabrication via risk-based Execution Classes (EXC1-EXC4) scaling requirements for welding, inspection, and traceability.
Key Components
- **EN 1090-1FPC certification, AVCP, DoP, Notified Body oversight.
- **EN 1090-2/-3Technical rules for steel/aluminium (materials, joining, tolerances, corrosion). Built on ISO 3834 for welding; ~100+ clauses with certification model.
Why Organizations Use It
- Mandatory for EU/EEA market access and CE marking.
- Mitigates liability, reduces rework via disciplined processes.
- Wins tenders, builds stakeholder trust; strategic for fabricators.
Implementation Overview
Phased: gap analysis, FPC development, training, NB audits (3-12 months). Targets steel/aluminium fabricators in Europe; requires ongoing surveillance.
Key Differences
| Aspect | IEC 62443 | EN 1090 |
|---|---|---|
| Scope | IACS cybersecurity lifecycle, zones, security levels | Steel/aluminium structural fabrication, conformity assessment |
| Industry | Industrial automation, OT sectors globally | Construction, structural engineering in EU/EEA |
| Nature | Voluntary consensus framework, certifications | Mandatory harmonized standard for CE marking |
| Testing | Risk assessments, SL-T/C/A verification, ISASecure | FPC audits, ITT/ITC, NB surveillance inspections |
| Penalties | Loss of certification, supply chain exclusion | Market exclusion, fines, legal liability under CPR |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about IEC 62443 and EN 1090
IEC 62443 FAQ
EN 1090 FAQ
You Might also be Interested in These Articles...
ISO 27701 Standalone Certification in 2025: Debunking Myths and Navigating the New Reality
Debunk myths on ISO 27701 standalone certification post-2025. Clarify viability, accreditation bodies, ISO 27001 audit differences & procurement benefits. Guide
5 Ways Modern Compliance Software Makes Evolving Regulations Your Strategic Advantage
Discover 5 ways modern compliance software turns evolving regulations into strategic advantage. Automate monitoring, cut 3x non-compliance costs, stay audit-rea
CMMC Sustainment Mastery: Continuous Monitoring, Annual Affirmations, and Subcontractor Flow-Down Playbook
Master CMMC sustainment beyond certification: continuous monitoring dashboards, SPRS/eMASS affirmations, enforceable subcontractor clauses. Get templates for ve
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
WEEE vs NERC CIP
Unlock WEEE vs NERC CIP: EU e-waste directive meets US grid cyber standards. Compare scopes, compliance strategies & targets for global ops success today!
ISO 27001 vs AS9110C
Compare ISO 27001 vs AS9110C: Info security mastery meets aerospace QMS rigor. Uncover key differences in risk, controls & compliance for resilience. Explore now!
NIST CSF vs AS9100
Compare NIST CSF vs AS9100: How NIST's flexible cyber framework aligns with AS9100's aerospace quality rigor for superior risk management. Boost compliance—discover now!