The Framework lays the foundations for strategic decisions and design activities using a “risk-based” approach and a planning and development model which defines the appropriate security measures throughout the whole life of the applications, processes and services (“cyber security by design”).