How mapping security controls can ease the compliance burden