A voluntary framework developed by NIST that provides guidelines for managing and reducing cybersecurity risk based on existing standards.