Understanding Risk Assessment in NIST 800-171 & CMMC