A very important consideration when selecting a framework is necessary customization. It is unlikely that a single framework will fit your needs perfectly, so you have to expect to tailor a framework for your specific needs (e.g., add to it, remove unnecessary content or merge multiple frameworks). From a customization perspective, think of "bolting on" content to a cybersecurity frameworks similar to the concept of gnawing off the square sides of a peg to make it fit into a round hole - it will eventually fit but it likely will not look very good or fit very well. This is the downside of customizing cybersecurity frameworks to add content that the framework lacks. It is generally less painful/costly to align with a more robust framework and remove content than it is to start with a lesser framework and add content.