I'm currently writing a paper about security standards. Therefore several terms have to be defined before I can actually start. The problem is that in every resource the term "Framework" is somehow connected to the terms "Standard", "Guideline", "Procedure" and "Policy". However, I fail to find a general definition for the term, since every resource defines it in a different way. E.g
- "A Framework is an assembly of standards, guidelines and best practices, which helps organizations at managing their assets and reaching their goals"
- "An information security framework is a series of documented processes that are used to define policies and procedures around the implementation and ongoing management of information security controls in an enterprise environment"
- "A Framework is a general guideline that an organization can adopt."
- "A framework is at best, a frame that can be used as a practice."
So, obviously people have completely different definitions for a framework. But which one is correct? Any experts here that can give me a short explanation?