Frameworks for IT risk management facilitate the systematical identification, analysis and coping of threats and risks in the IT environment. Without an effective handling of risks, the danger will increase that a company will have to face significant damages and, because of the consequences, might even have to cease business operations. Frameworks facilitate not only the quasi-mandatory application of IT risk management, but also offer other advantages from the view of resource use and quality. By using frameworks, e.g. the transparency and comparability of activities and results in IT risk management will be increased. In general, frameworks are highly recommended, but the large number of available frameworks is difficult to understand and, at first sight, they can hardly be differentiated. This raises the question of what framework actually fits into the company. This article facilitates the confrontation with frameworks of IT risk management by introducing common frameworks and explaining their differences and possible applications. Among other things, it describes which framework can be used to obtain the fastest results, which framework is suitable for definitions, which framework refers to actors, scenarios or assets, and with which framework the maturity level of processes can be assessed. Sometimes also a combination of selected frameworks is suitable to cover the individual situation and the expectations of a company in the most suitable way.