NIS2
EU directive strengthening cybersecurity for critical infrastructure sectors
EN 1090
EU standard for execution of steel and aluminium structures
Quick Verdict
NIS2 mandates cybersecurity resilience for EU essential entities via risk management and reporting, while EN 1090 requires certified FPC and CE marking for structural metal fabricators. Companies adopt NIS2 for regulatory compliance and threat mitigation; EN 1090 for market access and quality assurance.
NIS2
Directive (EU) 2022/2555 (NIS2)
Key Features
- Size-cap rule covers medium/large entities in expanded sectors
- Strict incident reporting with 24h early warning, 72h notification
- Direct senior management accountability for cybersecurity compliance
- Continuous risk management including supply chain security measures
- Fines up to 2% global annual turnover for non-compliance
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Factory Production Control (FPC) certification required
- Execution Classes (EXC1-4) scale risk-based requirements
- CE marking for EU market access
- Welding coordination per ISO 3834
- Full material and process traceability
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
NIS2 Details
What It Is
NIS2 Directive (Directive (EU) 2022/2555) is an EU regulation expanding the original NIS Directive's scope to enhance cybersecurity resilience across member states. It targets essential and important entities in critical sectors like energy, transport, health, and digital services, using a risk-based approach for risk management, incident handling, and governance.
Key Components
- **Risk managementContinuous assessments, supply chain security, access controls, encryption.
- **Incident reporting24-hour early warnings, 72-hour notifications, one-month final reports to CSIRTs.
- **Corporate accountabilitySenior management and boards directly liable.
- **Business continuityResilience plans and recovery procedures. Incorporates standards like ISO 27001, NIST CSF; enforced via audits and spot checks.
Why Organizations Use It
- Mandatory for in-scope entities to avoid fines up to €10M or 2% global turnover.
- Reduces cyber risks, ensures service continuity.
- Builds trust with stakeholders, regulators.
- Enables proactive resilience amid evolving threats.
Implementation Overview
Applies to medium/large entities (50+ employees, €10M+ turnover) EU-wide. Involves gap analysis, policy updates, training, registration by Oct 2024. Tailor to national transpositions; ongoing monitoring required.
EN 1090 Details
What It Is
EN 1090 is a harmonized European standard family for the execution and conformity assessment of structural steel and aluminium components. It supports CE marking under the Construction Products Regulation (CPR). The primary purpose is ensuring safe fabrication, assembly, and market placement of load-bearing metal structures. It uses a risk-based approach via Execution Classes (EXC1–EXC4) scaling requirements by failure consequences.
Key Components
- **EN 1090-1Conformity assessment, Factory Production Control (FPC), and Declaration of Performance (DoP).
- **EN 1090-2/-3Technical rules for steel/aluminium execution (welding, tolerances, corrosion protection).
- Core areas: traceability, welding (ISO 3834), inspection/NDT, tolerances.
- AVCP systems with Notified Body certification and surveillance.
Why Organizations Use It
Mandated for EU market access; reduces liability, ensures quality. Benefits: risk mitigation, rework reduction, market credibility. Builds stakeholder trust via certified FPC and CE marking.
Implementation Overview
Phased: gap analysis, FPC build, welding qualification, NB certification. Applies to fabricators in construction; 3–12 months typical. Requires audits, training for EXC capability.
Key Differences
| Aspect | NIS2 | EN 1090 |
|---|---|---|
| Scope | Cybersecurity risk management, incident reporting | Structural steel/aluminium fabrication, conformity |
| Industry | Essential/important entities across EU sectors | Steel/aluminium structural component manufacturers |
| Nature | Mandatory EU directive, national transposition | Harmonized standard under CPR, CE marking |
| Testing | Risk assessments, incident simulations | FPC certification, NDT, surveillance audits |
| Penalties | Up to 2% global turnover fines | Market exclusion, certificate suspension |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about NIS2 and EN 1090
NIS2 FAQ
EN 1090 FAQ
You Might also be Interested in These Articles...
NIST 800-53 Private Sector ROI Reality Check: Isolating Control Family Impacts on 2024 Breach Costs
Discover NIST 800-53 ROI in private sector: control families like RA, SI, SR reduce median breach costs from $100K to under $50K. Get benchmarks to prioritize i
You Guide on how to Start Implementing NIS2 in Your Organization
Master NIS2 implementation with our detailed guide. Learn requirements, risk assessment, supply chain security, and compliance steps for your organization. Star
Top 5 Unseen Complexities Modern Compliance Software Effortlessly Manages
Uncover top 5 unseen complexities modern compliance software manages effortlessly—from sensitive data mapping to real-time regulatory shifts. Automate audits, i
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
ISO 37001 vs ISO 17025
Compare ISO 37001 vs ISO 17025: Anti-bribery ABMS (37001) for ethical risk control vs lab competence (17025) for precise testing. Uncover scopes, benefits & paths to certification. Dive in!
ISO 27032 vs AS9120B
ISO 27032 vs AS9120B: Compare cybersecurity Internet guidelines with aerospace distributor QMS. Key differences in scope, risks, compliance & implementation. Boost resilience—explore now!
CMMC vs LEED
CMMC vs LEED: Compare DoD cybersecurity tiers (NIST-based) with green building points system. Key differences, costs, strategies & implementation for dual compliance success.