ETSI GS ISI 001-1 provides a complete set of information security indicators (based on already existing results and hands-on user experience), covering both security incidents and vulnerabilities. These indicators become evidence of non-compliance to a security policy when they violate an organization's security policy. The present document is meant to help CISOs and IT security managers in their effort to accurately evaluate and benchmark their organization's security posture. ETSI GS ISI 001-2 [3] gives precise instructions on how to use the present document and select indicators.