The IESNA guideline for security lighting (IESNA G-1-03) has some very specific procedures for taking light reading measurements in Annex C at the back of the document.
Traditionally, horizontal illumination (meter facing towards the sky) has been used when establishing lighting guidelines, but as John suggests, vertical illumination (meter facing towards the camera or person viewing) provides a more useful reading for practical purposes.
I have found that it generally makes very little difference if the meter is on the ground or at 4' off the ground. An exception would be when the principal source of light in the area is pathway lights that are mounted down low. In this case, you need to get the meter down on the ground. (Not that pathway lighting is that useful for surveillance).
I think that handheld light meters are best used to establish the order of magnitude of lighting (is it 1 lux, 10 lux, or 100 lux) rather than to obtain precise readings. I own several different light meters and sometimes place them side-by-side when taking readings. I often see variations of as much as 20% between meters. I also take a reading, then go back to the same spot later to take the reading again, and the readings almost never match. So again, I think that light readings taken in the field provide a good approximation of conditions, but shouldn't be considered scientific by any means.
The IACLEA standards are very aggressive and I would be surprised if they are actually followed by many institutions. I have taken light readings at hundreds of sites over the years, and I would say that less than 5% of them have lighting at the levels that IACLEA suggests.
We are starting to get more and more pushback from architects these days about security lighting, and I often have to fight like hell to get the one-footcandle (10 lux) minimum light level that I normally suggest. I had one hospital project recently where the architect was going for a LEED Platinum certification and suggested no lighting at all in the parking lots. I was able to overrule this insanity, but didn't get anywhere near the light levels I wanted.
Frank, I think that your approach of presenting both the IACLEA recommended light level and a more practical light level is a good one. The client owns the risk and it is ultimately up to them to make the decision. Our job as consultants is to provide them with the necessary information.