Saw many tools which help with assessment of CMCC and NIST compliance. Did anyone come across documentation or tool which list of remediation plan to meet (or exceed) the security requirements?

For example, many requirements can be met with deploying policies, some with tools or process.

Thanks in advance for your help.