Security control standardization