Assessing implemented security controls