The first question I asked the VA is similar to the first questions I ask on most measurement problems: “What decision is this measurement for?” Then, shortly thereafter, I ask: “What do you mean by ‘IT security’? What does improved IT security look like?
