IEC 62443 vs EN 1090
IEC 62443
International standard for IACS cybersecurity frameworks
EN 1090
EU standard for steel and aluminium structures execution
Quick Verdict
IEC 62443 secures industrial control systems via risk-based cybersecurity frameworks globally, while EN 1090 mandates CE marking for structural steel/aluminium in EU construction through FPC and execution classes. Companies adopt IEC for OT resilience, EN 1090 for legal market access.
IEC 62443
IEC 62443: Security for industrial automation systems
Key Features
- Risk-based zones and conduits segmentation model
- Security levels SL-T, SL-C, SL-A triad
- Shared responsibility across asset owners, integrators, suppliers
- Seven foundational requirements FR1-FR7 taxonomy
- ISASecure modular certifications for components, systems
EN 1090
EN 1090: Execution of steel and aluminium structures
Key Features
- Risk-based Execution Classes (EXC1-EXC4)
- Certified Factory Production Control (FPC)
- CE marking under CPR for market access
- ISO 3834-aligned welding quality management
- Full material and process traceability
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
IEC 62443 Details
What It Is
IEC 62443 is the ISA/IEC series of consensus-based standards for securing Industrial Automation and Control Systems (IACS). It provides a comprehensive, risk-based framework spanning governance, risk assessment, system architecture, and component requirements tailored to OT environments.
Key Components
- Four groupings: General (-1), Policies (-2), System (-3), Components (-4).
- Seven foundational requirements (FR1-7) like identification, integrity, restricted flows.
- Zones/conduits model and security levels (SL 0-4) with SL-T, SL-C, SL-A.
- ISASecure certifications (SDLA, CSA, SSA) for modular conformance.
Why Organizations Use It
- Mitigates OT-specific risks to safety, availability, production.
- Enables shared responsibility, supply chain assurance.
- Supports regulatory compliance, insurance benefits, procurement standards.
- Builds stakeholder trust via certified maturity levels.
Implementation Overview
- Phased: governance (2-1 CSMS), risk assessment (3-2), controls (3-3/4-2), certification.
- Applies to asset owners, integrators, suppliers across industries.
- Requires OT-aware audits, training; multi-year for full maturity.
EN 1090 Details
What It Is
EN 1090 is the European harmonized standard family (EN 1090-1 to -5) for execution and conformity assessment of steel and aluminium structural components. It implements the EU Construction Products Regulation (CPR), enabling CE marking. Primary purpose: ensure safe fabrication via risk-based Execution Classes (EXC1-EXC4) scaling requirements for welding, inspection, and traceability.
Key Components
- EN 1090-1 FPC certification, AVCP, DoP, Notified Body oversight.
- EN 1090-2/-3 Technical rules for steel/aluminium (materials, joining, tolerances, corrosion). Built on ISO 3834 for welding; ~100+ clauses with certification model.
Why Organizations Use It
- Mandatory for EU/EEA market access and CE marking.
- Mitigates liability, reduces rework via disciplined processes.
- Wins tenders, builds stakeholder trust; strategic for fabricators.
Implementation Overview
Phased: gap analysis, FPC development, training, NB audits (3-12 months). Targets steel/aluminium fabricators in Europe; requires ongoing surveillance.
Key Differences
| Aspect | IEC 62443 | EN 1090 |
|---|---|---|
| Scope | IACS cybersecurity lifecycle, zones, security levels | Steel/aluminium structural fabrication, conformity assessment |
| Industry | Industrial automation, OT sectors globally | Construction, structural engineering in EU/EEA |
| Nature | Voluntary consensus framework, certifications | Mandatory harmonized standard for CE marking |
| Testing | Risk assessments, SL-T/C/A verification, ISASecure | FPC audits, ITT/ITC, NB surveillance inspections |
| Penalties | Loss of certification, supply chain exclusion | Market exclusion, fines, legal liability under CPR |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about IEC 62443 and EN 1090
IEC 62443 FAQ
EN 1090 FAQ
You Might also be Interested in These Articles...
The DORA 'Hot Seat' Blueprint: Preparing Leadership and the Management Body for Regulatory Interviews
Prepare your Board & Management Body for DORA audits. Master the human element: demonstrate active oversight & accountability in regulatory interviews. Get the
The Tool Landscape for Reaching and Maintaining ISO 27001 Compliance
Discover top ISO 27001 compliance tools, their pros/cons, implementation steps, costs, and benefits. Streamline your path to certification and ongoing complianc
SOC 2 Trust Services Criteria in Plain English: Side-by-Side Decoder with Real-World Analogies
Decode SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) into plain English with tables, TL;DRs & analogies
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Explore More Comparisons
See how IEC 62443 and EN 1090 compare against other standards