A systematic review of voluntary cybersecurity standards and frameworks

As the world becomes increasingly digitalised, cyber insecurity has become the monster under the bed, an unseen threat that many either remain unaware of or ignore, hoping it will simply vanish. In today’s digital landscape, nearly every individual with a digital footprint has, at some point, encountered spam calls or emails containing offers that appear too good to be true or attempt to induce fear and coerce them into parting with their money. Organisations of all sizes are on the front lines of this cyber war. A 2024 cybersecurity breaches survey by the UK Home Office found several organisations reported receiving countless phishing emails and other cyberattacks daily. This study evaluates and ranks the leading voluntary cybersecurity frameworks and standards based on their relevance and adoption in the academic and professional communities. A systematic review identified 12 voluntary cybersecurity frameworks and 17 cybersecurity standards. The top five frameworks and standards from each category were analysed, with the key components of each outlined in detail. The ranking system developed for this study was based on academic research interest, highlighting the cybersecurity measures most frequently studied and discussed in scholarly literature. The results provide a comprehensive overview of the most influential voluntary cybersecurity frameworks and standards, providing valuable insights for organisations seeking to improve their cybersecurity posture through voluntary measures. This study aimed to contribute to the ongoing discussion of how voluntary cybersecurity initiatives can complement regulatory efforts in safeguarding digital infrastructure.