Add functionality to create secure tenant from a CIS tenant template

Ooo. This sounds intriguing.

I know a lot of the partners I work with are usually inheriting existing tenants instead of creating new ones.
Using NMM to create the tenant may have some technical hurdles to jump through, but modifying an existing tenant to be compliant with the CIS Benchmark (CIS Microsoft 365 Benchmarks) may be doable.

If we add the ability to apply CIS standards to an existing tenant and then manage drift like we can with our Solution Baselines, do you think that'll accomplish what you're wanting? 

being able to apply the CIS standards would indeed be acceptable if “creating” one isn't doable.