The technology risk community, whether IT Auditors or Information Security professionals, appreciate information security frameworks because they

1. provide policy templates and operating procedures

2. provide structure and guidance

3. are designed to achieve specific outcomes

4. provide structure and procedures