Security controls evaluation, testing, and assessment handbook - Johnson, Leighton (Syngress, 2015)