Reinforcing the Centrality of the Security Controls Function