Centralized Management of Proactive Controls in AWS Control Tower for SOC 2 Certification

I have been working with AWS Control Tower and am interested in managing proactive controls for my multiple AWS accounts as part of our SOC 2 certification efforts. While exploring CloudFormation hooks for governance, I found them unsuitable for my needs.

I am looking for a centralized configuration tool or solution to enable proactive controls across all my accounts. Additionally, I would like a template that ensures these proactive controls, such as managing S3 bucket public access, EFS encryption, IAM policies for users, and two-factor authentication setup, are automatically enabled when creating new accounts under AWS Control Tower.

What are the best practices, tools, or approaches available to achieve this centralized management? Any insights or recommendations would be greatly appreciated!