Agree that adding NIST controls would be great - so far we've focused on CIS, PCI and HIPAA.