Security control selection is a risk management activity which involves selecting security controls that will most effectively protect a given system. Given that numerous constraints must be considered during control selection, various approaches have been proposed to assist with this decision. However, even with the support of automated solutions, the scalability of these approaches is limited by the underlining complexity of this problem. As a result, in this work, we create a tool that enables scalable automation for control selection approaches. The tool is based on a previously proposed game-theoretic approach, but could be modified to support any other control selection approach. Scalability is achieved by the development of a novel algorithm that finds suggested security control combinations for a system while considering control dependencies and budgetary constraints. As the problem addressed by the algorithm is a variation of the bounded 0–1 knapsack problem with dependencies between items, we prove the functionality of the algorithm and demonstrate that it has computational complexity O(n) in special cases.