If you're in IT and your job involves securing your organizations' infrastructure, you've probably spent a good deal of time thinking through control selection -- in other words, picking the controls that most directly help you accomplish the goal of securing your environment.