A voluntary security framework is one that organizations can choose to adopt but are not required to do so. It provides guidance based on existing standards, guidelines, and practices to help organizations manage and reduce cybersecurity risks. Rather than imposing a one-size-fits-all checklist, the framework allows customization to suit an organization’s unique risks, vulnerabilities, and risk tolerances.