Those are pervasive because they provide a universal baseline for security requirements across the world.

Those frameworks should be treated as guidelines to build a mature security programme, and not just tickbox exercise.