A CISO’s Guide to Security Control Rationalization