NIST CSF
Voluntary framework for managing cybersecurity risks organization-wide
EN 1090
EU standards for execution and CE marking of steel/aluminium structures
Quick Verdict
NIST CSF provides voluntary cybersecurity risk management for all organizations worldwide, while EN 1090 mandates CE marking and FPC for EU structural steel/aluminium fabricators. Companies adopt NIST for flexible risk reduction; EN 1090 for legal market access.
NIST CSF
NIST Cybersecurity Framework Version 2.0
Key Features
- Six core functions including new Govern for lifecycle coverage
- Four Implementation Tiers assessing risk management maturity
- Current and Target Profiles enabling gap analysis
- Common language fostering stakeholder communication
- Flexible mappings to standards like ISO 27001
EN 1090
EN 1090: Execution of steel and aluminium structures
Key Features
- Risk-based Execution Classes (EXC1-EXC4)
- Factory Production Control (FPC) certification
- CE marking and Declaration of Performance
- Welding quality management via ISO 3834
- Material traceability and NDT inspection
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
NIST CSF Details
What It Is
NIST Cybersecurity Framework (CSF) 2.0 is a voluntary, risk-based guideline developed by NIST for managing cybersecurity risks. It provides organizations a flexible structure to identify, protect, detect, respond, recover, and govern cyber risks across any size or sector.
Key Components
- **Six Core FunctionsGovern (new), Identify, Protect, Detect, Respond, Recover.
- **Framework CoreOrganized into Functions, 22 Categories, 112 Subcategories with informative references to standards like ISO 27001.
- **Implementation TiersFour levels (Partial to Adaptive) for maturity assessment.
- **ProfilesCurrent vs. Target for gap analysis. No formal certification; self-attestation used.
Why Organizations Use It
Enhances risk prioritization, stakeholder communication, supply chain management. Demonstrates due care, supports compliance (mandatory for U.S. federal), builds trust, elevates cybersecurity to board level.
Implementation Overview
Create Profiles, assess Tiers, map to existing controls. Quick starts via tools/guides; scalable for SMEs to enterprises globally. Focuses on outcomes, not prescriptions; ongoing via continuous monitoring.
EN 1090 Details
What It Is
EN 1090 is a family of European harmonized standards—EN 1090-1 for conformity assessment, EN 1090-2 for steel structures, and EN 1090-3 for aluminium—under the EU Construction Products Regulation (CPR). It governs fabrication, assembly, and CE marking of load-bearing structural components and kits for construction works. Adopts a risk-based methodology via Execution Classes (EXC1-4), scaling requirements by failure consequences, service conditions, and production complexity.
Key Components
- **Factory Production Control (FPC)Certified system for traceability, inspection, and processes.
- **Execution ClassesMatrix from consequence/service/production categories.
- **Technical requirementsWelding (ISO 3834), tolerances, corrosion protection, NDT.
- **Conformity modelNB certification, ITT/ITC, DoP, ongoing surveillance.
Why Organizations Use It
- Mandatory for EU/EEA market access and CE marking.
- Mitigates liability, ensures consistent quality.
- Enables high-risk projects (EXC3/4), builds stakeholder trust.
- Drives efficiency, reduces rework, enhances competitiveness.
Implementation Overview
Phased approach: gap analysis, FPC development, personnel/welding qualification, NB audits. Targets fabricators in construction; 3-12 months typical. Requires certified FPC and surveillance. (178 words)
Key Differences
| Aspect | NIST CSF | EN 1090 |
|---|---|---|
| Scope | Cybersecurity risk management across organizations | Execution of steel/aluminium structural components |
| Industry | All sectors worldwide, any size | Construction/structural fabrication, EU/EEA market |
| Nature | Voluntary risk framework, no certification | Harmonized standard, mandatory CE marking |
| Testing | Self-assessment via Profiles/Tiers | Notified Body FPC certification/surveillance audits |
| Penalties | No legal penalties, reputational risk | Market exclusion, fines, certificate suspension |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about NIST CSF and EN 1090
NIST CSF FAQ
EN 1090 FAQ
You Might also be Interested in These Articles...
NIST 800-53 Private Sector ROI Uncovered: 2025 Podcast Deep Dive into Control Family Impact on $10M+ Breach Aversions
Uncover NIST 800-53 ROI in healthcare & finance: RA, SI, IR controls break even after 1-2 incidents ($100K-$10M savings). Podcast deep dive with CISO metrics fo
HITRUST CSF MyCSF Platform Mastery: Infograph of Evidence Tagging Workflows and Top 5 Maturity Tier Acceleration Takeaways
Master MyCSF platform with infographics on evidence tagging for 1,400+ HITRUST controls across 19 domains. Cut documentation by 30%, boost Measured/Managed tier
NIST SP 800-53 Rev 5.1 Private Sector Tailoring Blueprint: First 5 Steps to Overlay-Driven Compliance with Infographic
Step-by-step blueprint for private sector NIST SP 800-53 Rev 5.1 tailoring using overlays for AI & supply chain risks. Infographic + first 5 steps for ROI-drive
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
IFS Food vs ISO 14064
Compare IFS Food vs ISO 14064: Food safety audits vs GHG emissions standards. Uncover key differences in scope, audits, and compliance for manufacturers. Optimize your strategy today!
ISO 55001 vs EU AI Act
Explore ISO 55001 vs EU AI Act: Compare asset governance, risk frameworks & compliance. Unlock synergies for AI-driven asset management & resilient operations today.
NIST CSF vs SQF
Compare NIST CSF vs SQF: Key frameworks for cyber risk & food safety compliance. Discover differences, benefits & strategies to optimize your program today.