Security control system and method

A security control method, constituted of: receiving risk analysis information comprising data regarding a plurality of threats, each of the plurality of threats associated with a respective asset; loading a control database comprising data regarding a plurality of security controls; for each of the plurality of threats, matching one or more of the plurality of security controls to one or more attack steps of one or more attack paths associated with the respective threat; for each of the plurality of threats, selecting at least a subset of the matched security controls; and for each of the plurality of threats, outputting information regarding the selected security controls.