What It Is

PCI DSS (Payment Card Industry Data Security Standard) is a contractual industry standard managed by the PCI Security Standards Council. It mandates technical and operational requirements to protect cardholder data (CHD) and sensitive authentication data (SAD) for entities storing, processing, or transmitting payment card information. Structured around 12 requirements in 6 control objectives, it uses a control-based approach with over 300 sub-requirements.

Key Components

• **Core structureNetwork security, data protection, vulnerability management, access controls, monitoring/testing, and policies.
• **PCI DSS v4.0Introduces customized approaches, MFA emphasis, and third-party risk.
• **Compliance modelTiered levels (1-4 for merchants, 2 for service providers); validated via SAQ, ROC, ASV scans, and QSA audits.

Why Organizations Use It

• Contractual obligation for card handlers, avoiding fines, bans, and breach costs ($37/record avg.).
• Reduces fraud, builds customer trust, enables market access.
• Enhances risk management and operational maturity.

Implementation Overview

• **Assess-Repair-Report cycleScope CDE, gap analysis, remediate, validate.
• Applies globally to all sizes handling cards; 6-12 months typical, high complexity/cost.

What It Is

EN 1090 is the harmonized European standard family for the execution of steel and aluminium structural components and kits. It serves as a regulatory framework under the EU Construction Products Regulation (CPR), enabling CE marking through conformity assessment. The primary purpose is to ensure controlled fabrication, assembly, and performance declaration for load-bearing components in construction works. It employs a risk-based approach via Execution Classes (EXC1–EXC4), scaling requirements by consequence, service, and production categories.

Key Components

• **EN 1090-1Conformity assessment, Factory Production Control (FPC) certification, Declaration of Performance (DoP).
• **EN 1090-2/-3Technical rules for steel/aluminium (materials, welding, tolerances, corrosion protection, inspection/NDT).
• Core principles: Traceability, welding quality (ISO 3834), risk-proportional controls.
• Compliance model: Notified Body certification of FPC with ongoing surveillance.

Why Organizations Use It

Mandated for EU market access; reduces liability, ensures safety. Benefits include defect reduction, market credibility, and capability for high-risk projects. Builds stakeholder trust via auditable processes.

Implementation Overview

Phased: Gap analysis, FPC development, personnel training, NB certification. Applies to fabricators in construction; 3–12 months typical. Requires audits, welding qualifications.