Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans (NIST SP 800-53A, Revision 1)