The Security Auditor's Guidebook for NIST 800-171