An open-source ML framework for mapping CVE vulnerabilities to NIST compliance controls using a fine-tuned 110M parameter encoder. The approach outperforms zero-shot foundation models and 7B LLMs, achieving 77.45% top-1 accuracy through contrastive fine-tuning, while hybrid search and generative reranking degrade performance.