What is the difference between CIS Controls v8 and CIS Benchmarks?

More context

The two publications connect through secure configuration: CIS Controls v8 includes a control dedicated to secure configuration of enterprise assets and software, and the CIS Benchmarks are the published implementation detail for it. An organization adopting the Controls uses the Benchmarks to make the configuration control concrete and measurable per technology.

This split also determines tooling: Controls adoption is largely a program and governance exercise tracked in assessments, while Benchmark conformance is machine-checkable. Continuous benchmark scanning is how the configuration layer of a CIS Controls program gets verified in practice, and it doubles as evidence under frameworks like the Ohio Data Protection Act safe harbor that recognize CIS conformance.