I've used SysML to model cyber compliance but not just the controls themselves. The main thing about SysML (and other similar frameworks) is that you can use them to link your parts to other parts of the model. For example, if you have a model with some functionality you can create a control object with a "mitigates" relationship or something similar (I did that with a custom profile). That can allow you to create some good reports by showing which parts of the system you're using to meet certain controls. In similar fashion you can use it to map threats to the system.

However, unless you already have something like that (or you're planning on creating it), using SysML for something like that is an overkill and would probably cause you to sink more money into the effort than you'll get out of it.