Unfathomable a few decades ago, the velocity of revolution in information technology (IT) security is accelerating. Small and midsized enterprises (SMEs) continue to make IT security a highest priority and foster security controls to safeguard their environments from adverse effects. Information technology security professionals must rely on one of many information security risk assessment (ISRA) frameworks to help implement secure security controls. Determination of a suitable ISRA framework has challenged IT security professionals. Undoubtedly, choosing the correct security framework for a given SME is an important decision. However, IT professionals at many SMEs lack a good understanding of the nuances between various frameworks. Common among the frameworks are certain attributes and sub-attributes, which must be considered and evaluated to determine the best framework for a given organization. The crux of the research emanated from this phenomenon. This research study utilized a qualitative Delphi methodology. The study explored the various attributes and sub-attributes that must be considered when evaluating a security framework. Information technology security experts were invited to share their opinions and perceptions regarding the relative importance of specific frameworks' attributes and sub-attributes versus other attributes and sub-attributes. The group reached consensus in the fourth round. The study aimed to extend the security officers perceptions to help determine a security framework suitable for their organization. [The dissertation citations contained here are published with the permission of ProQuest LLC. Further reproduction is prohibited without permission. Copies of dissertations may be obtained by Telephone (800) 1-800-521-0600. Web page: http://www.proquest.com.bibliotheek.ehb.be/en-US/products/dissertations/individuals.shtml.]