Cyber security frameworks are sets of documents describing guidelines, standards, and best practices designed for cyber security risk management. The frameworks exist to reduce an organization's exposure to weaknesses and vulnerabilities that hackers and other cyber criminals may exploit.

The word “framework” makes it sound like the term refers to hardware, but that’s not the case. It doesn’t help that the word “mainframe” exists, and its existence may imply that we’re dealing with a tangible infrastructure of servers, data storage, etc.

But much like a framework in the “real world” consists of a structure that supports a building or other large object, the cyber security framework provides foundation, structure, and support to an organization’s security methodologies and efforts.