Probably too late, but first, I feel your pain. And to top it off, authorizing officials (AOs) usually want the controls documented in MS Word, a static solution that does not match the requirements of today's rapid release CI/CD pipelines. So after writing my first ATO by hand, I vowed never to do that again.
For starters, look at OpenControl which defines a machine-readable, YAML-based language for capturing control state, the system specific control text narrative and (ideally) a verification process. Experiment with OpenControl using the example project freedonia-compliance which uses compliance-masonry to generate the documentation.
I have used OpenControl to create markdown-based documentation in git for several federal clients. Then pandoc can be run against that to create the Word docs AOs want. (I have not yet managed to get an AO to look at git as, well, they have check boxes that need checking and git is not one of them. Things need to change...)
You might also want to look at GovReady, a security compliance company that we (CivicActions) are in partnership with. I am using their hyperGRC tool to help with creating System Security Plan (SSP) documentation, and we are currently exploring ways to attach real-time evidence gathering and control verification for ongoing authorization (the mantra of the RMFv2).
The next step is to integrate control management directly into the CI/CD pipeline so that as configurations change, so does the compliance documentation.
There's a similar project that NIST is working on called OSCAL (Open Security Controls Assessment Language) that looks promising. We are currently working with both schemas, and there is an oscalkit for conversion from OpenControl to OSCAL.