When comparing and contrasting the NIST Cybersecurity Framework to the COBIT Framework:

Question: Are these frameworks voluntary or mandatory compliance requirements? Even if a framework is not mandatory, does an organization have an ethical responsibility to protect information security? Why or why not?