A structured set of guidelines and best practices for managing cybersecurity risk, such as NIST CSF, ISO 27001, or CIS Controls.