References attached. Input was RHEL7 XCCDF build from master branch.
The origins of these are found subordinate to
shared/xccdf(there are 853 occurrences, many of which have no NIST citation, with 5 others in
RHEL/7/input/auxiliary/nist_support.xml). The "raw" citations reference only controls, not revision+control, so any cleanup accommodating multiple 800-53 revisions would require altering not only the
<ref>s but the build logic.