Interesting work from NIST and NVD that takes 800-53 and maps controls down to the configuration level. Potential to allow low level compliance checks against OSA patterns.
http://nvd.nist.gov/scap.cfm