Models in general and our metamodel in this instance can
help by instantiating the control concept as well as putting
various controls in relation to each other using the recursive
relation. This helps orchestrating a set of controls, e.g. to
model a so-called “defense in-depth” approach, where
multiple layers of protection are setup so potential attackers
need to overcome various obstacles in their attempt to breach
security.