Therequirementtomeasureinformationtechnology(IT)securityperformanceisdrivenby regulatory,financial,andorganizationalreasons.Anumberofexistinglaws,rules,and regulationsciteITperformancemeasurementingeneral,andITsecurityperformance measurementinparticular,asareq