If you have any SLA defined from the client side, then you should compare the Response Time to that SLA like your client says application should have 5 secs of Response time with 500 users, then if your application is not showing that behavior then you need performance tuning.
If you don't have any SLA then you can use the general theory, that any response time Greater than 4 seconds is a long delay and causes issues to end users too (this is based on "The Art of Application Performance Testing" by "Ian Molyneaux"), although exceptions are always there (How heavy is your application/page, Number of users, Network I/O etc.)
Plot graph for Throughput and Response Time against users. Means User Number should be on X-axis and Throughput, Response Time should be on Y-axis. In ideal situations Throughput should be a parabola (in actual situation a distorted parabola) i.e. First it should increase with users and then after attaining a maximum value it should decrease with users, while Response Time should be increasing linearly with users. So the point where Throughput and Response Time graph intersects each other after Throughput has attained it maximum value, that point is the Threshold point, this is the number of maximum users supported by your application with current hardware configuration.
- If this Threshold value of users is less than required than you need to Performance Tune your application and need to upgrade the Hardware.
- If this value is more than required than no need to performance tune or upgrade hardware.
Refer this image as an example for Throughput vs Response Time graph

Now, if after this analysis you think that hardware upgrade is required than analyze the Resource Utilization results, to see where is bottleneck in hardware i.e. you need more CPU Cores or RAM or anything else.
Also, if target is 1000 users then no there should be 0% error in your results, because error shows that users got some weird page or message, High Response time is different from Error page. So error should be 0% for the target number of users.
Note: We generally take 90% line value whenever we talk about Response Time in our analysis, for the worst case part you can go for the Maximum value too. But remember this is the maximum time taken by any user.
Refer this link for more detailed information
https://www.manageengine.com/products/qengine/performance-testing-report-analysis.pdf
Also, read "When do I stop" part of this link, it's good.
http://nico.vahlas.eu/2010/03/30/some-thoughts-on-stress-testing-web-applications-with-jmeter-part-2/