How do CIS benchmarks map to NIST 800-53?

More context

NIST 800-53 is a catalog of security and privacy controls for US federal information systems, and it is deliberately broad: it covers technical, operational, and management controls. CIS benchmarks are configuration-focused, so they naturally align with the technical, host-level families such as Access Control, Configuration Management, and Audit and Accountability. Governance and process families like planning or personnel security fall outside what a configuration scan can evidence.

The value of an explicit mapping is that a single benchmark scan can be reported against the framework a customer actually answers to. Rather than re-testing systems once for CIS and again for NIST, each passing or failing configuration check is tagged with the corresponding 800-53 control identifiers, so a control family owner can see coverage and gaps without translating between two vocabularies by hand.