NIST CSF
Voluntary framework for managing cybersecurity risks organization-wide
EN 1090
EU standards for execution and CE marking of steel/aluminium structures
Quick Verdict
NIST CSF provides voluntary cybersecurity risk management for all organizations worldwide, while EN 1090 mandates CE marking and FPC for EU structural steel/aluminium fabricators. Companies adopt NIST for flexible risk reduction; EN 1090 for legal market access.
NIST CSF
NIST Cybersecurity Framework Version 2.0
Key Features
- Six core functions including new Govern for lifecycle coverage
- Four Implementation Tiers assessing risk management maturity
- Current and Target Profiles enabling gap analysis
- Common language fostering stakeholder communication
- Flexible mappings to standards like ISO 27001
EN 1090
EN 1090: Execution of steel and aluminium structures
Key Features
- Risk-based Execution Classes (EXC1-EXC4)
- Factory Production Control (FPC) certification
- CE marking and Declaration of Performance
- Welding quality management via ISO 3834
- Material traceability and NDT inspection
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
NIST CSF Details
What It Is
NIST Cybersecurity Framework (CSF) 2.0 is a voluntary, risk-based guideline developed by NIST for managing cybersecurity risks. It provides organizations a flexible structure to identify, protect, detect, respond, recover, and govern cyber risks across any size or sector.
Key Components
- **Six Core FunctionsGovern (new), Identify, Protect, Detect, Respond, Recover.
- **Framework CoreOrganized into Functions, 22 Categories, 112 Subcategories with informative references to standards like ISO 27001.
- **Implementation TiersFour levels (Partial to Adaptive) for maturity assessment.
- **ProfilesCurrent vs. Target for gap analysis. No formal certification; self-attestation used.
Why Organizations Use It
Enhances risk prioritization, stakeholder communication, supply chain management. Demonstrates due care, supports compliance (mandatory for U.S. federal), builds trust, elevates cybersecurity to board level.
Implementation Overview
Create Profiles, assess Tiers, map to existing controls. Quick starts via tools/guides; scalable for SMEs to enterprises globally. Focuses on outcomes, not prescriptions; ongoing via continuous monitoring.
EN 1090 Details
What It Is
EN 1090 is a family of European harmonized standards—EN 1090-1 for conformity assessment, EN 1090-2 for steel structures, and EN 1090-3 for aluminium—under the EU Construction Products Regulation (CPR). It governs fabrication, assembly, and CE marking of load-bearing structural components and kits for construction works. Adopts a risk-based methodology via Execution Classes (EXC1-4), scaling requirements by failure consequences, service conditions, and production complexity.
Key Components
- **Factory Production Control (FPC)Certified system for traceability, inspection, and processes.
- **Execution ClassesMatrix from consequence/service/production categories.
- **Technical requirementsWelding (ISO 3834), tolerances, corrosion protection, NDT.
- **Conformity modelNB certification, ITT/ITC, DoP, ongoing surveillance.
Why Organizations Use It
- Mandatory for EU/EEA market access and CE marking.
- Mitigates liability, ensures consistent quality.
- Enables high-risk projects (EXC3/4), builds stakeholder trust.
- Drives efficiency, reduces rework, enhances competitiveness.
Implementation Overview
Phased approach: gap analysis, FPC development, personnel/welding qualification, NB audits. Targets fabricators in construction; 3-12 months typical. Requires certified FPC and surveillance. (178 words)
Key Differences
| Aspect | NIST CSF | EN 1090 |
|---|---|---|
| Scope | Cybersecurity risk management across organizations | Execution of steel/aluminium structural components |
| Industry | All sectors worldwide, any size | Construction/structural fabrication, EU/EEA market |
| Nature | Voluntary risk framework, no certification | Harmonized standard, mandatory CE marking |
| Testing | Self-assessment via Profiles/Tiers | Notified Body FPC certification/surveillance audits |
| Penalties | No legal penalties, reputational risk | Market exclusion, fines, certificate suspension |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about NIST CSF and EN 1090
NIST CSF FAQ
EN 1090 FAQ
You Might also be Interested in These Articles...
Thailand PDPA Implementation Guide: Subordinate Regulations for 72-Hour Breach Reporting and Cross-Border Transfers (2022-2024 Rules)
Step-by-step Thailand PDPA guide: 72-hour breach notifications, cross-border transfers (2022-2024 rules). Risk checklists, GDPR templates avoid THB 5M fines. Mu
CMMC Level 2 Implementation Guide for Small DIB Contractors: First 5 Steps to C3PAO Certification with Infographic
Actionable CMMC Level 2 guide for small DIB contractors: 5-step roadmap to C3PAO certification with infographic on timelines, costs & POA&Ms. Achieve DoD compli
Asset-Backed Issuers and SEC Cybersecurity Rules: Applicability, Disclosures, and Compliance Roadmap
How SEC cybersecurity rules apply to asset-backed issuers (ABS): Form 10-D disclosures, ABS-EE risk management, Inline XBRL tagging, exemptions. Roadmap for tru
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
EMAS vs MAS TRM
EMAS vs MAS TRM: Compare EU's eco-management scheme with Singapore's tech risk guidelines. Key differences in governance, compliance & strategy for global leaders. Dive in!
ITIL vs ISO 27701
Compare ITIL vs ISO 27701: ITSM excellence meets privacy governance. Align services with business via SVS & 34 practices, extend to PIMS controls. Choose wisely!
PRINCE2 vs IEC 62443
PRINCE2 vs IEC 62443: PRINCE2's 7 principles, practices & processes ensure governed project success; IEC 62443's zones, SLs secure IACS. Compare for optimal strategy!