Map findings to CVE / CIS benchmark references

For our compliance paperwork it would help if each finding cited the relevant CVE or CIS benchmark control number rather than a free-text description.