Too many baselines

I'm trying to validate for myself whether CIS Level 1 benchmarks are the appropriate endpoint configuration hardening step to take next in my environment. Is anyone aware of any resources that take the available pre-built GPOs from:

• Microsoft Security Baselines
• CIS Benchmarks Levels 1 and 2
• DISA STIGs

And diff / compare them? E.g. a spreadsheet with one row per setting, and a column for each benchmark, highlighting the ones that are not all the same?

I'd also like to know from others who have been in this position - knowing you need improvement on endpoint config hardening, but not having an external auditor or box-checker telling you what framework you have to use - what factors did you evaluate to make a decision between the available reputable benchmarks? What did you ultimately decide on, and in what sector?

I am looking at rolling out the CIS Level 1 benchmark GPOs in a K-12 school environment and am wondering if that is too lax, and whether the Microsoft security baselines are tighter or looser. I'm assuming CIS L2 and DISA STIGs are going to be too tight, disruptive and require a lot of exceptions, but would love to hear real world feedback on how these worked out for those who tried them.

Also, how do you handle the inevitable exceptions to benchmark settings?

• When a new version of the benchmark comes out and you import it, do you go through manually and make all the changes you have in your documentation again?
• Or do you rely on GPO precedence, link the benchmark GPO unmodified and implement exceptions in a separate GPO that takes precedence - so you can drop-in new versions of the benchmark and your overrides remain intact?
• Precedence would seem to be the medium-term future-proof option, but I understand precedence is not a concept in Intune and configuration profiles must be non-conflicting, so it is still not long-term future-proof if we assume we won't be hybrid-joining all devices forever.