Prove Security Control Effectiveness