In devising advice to help organizations identify which information security and privacy controls to adopt, NIST risk management expert Ron Ross, a NASCAR fan, looks to the way mechanics decide how to fix a car.