IT security metrics provides a practical approach towards measuring IT security. Determining security requirement is not about throwing numbers at management generated by a security tool.