1. A method for assessing the risk of an information technology based target system: a) providing one or more test requirements categories; b) associating one or more first data elements with each requirements category, wherein the first data elements represent a potential of threats to exploit a vulnerability; c) associating one or more second data elements with a degree of exposure of the target system to the one or more threats; d) comparing the first data elements to the second data elements to determine, based on predetermined rules, composite data elements for each requirements category; and e) selecting, based upon predetermined rules, a level of risk of the composite data elements as a baseline risk level for each requirements category.