ISMS Combined Phase I and Phase II Verification Specifics

DOE-HDBK-3027-99

6.3.5 ISMS Combined Phase I and Phase II Verification Specifics

As discussed in Section 5.4, a combined verification should be conducted only when it is clear

that the site had achieved a mature implementation of the ISMS. The ISMS should also be

consistent with the system description that was submitted to the HCA for approval. It is possible

to conduct a combined verification when the implementation is not complete or mature in some

known areas but which is complete and mature in a majority of the areas. A combined

verification should not be attempted when all of the mechanisms for implementation of the ISMS

Description have not been developed or have not been implemented.

The ISMS verification team for a combined verification should contain members with previous

ISMS verification experience as well as a good understanding of the site and the work that is

conducted at the site. Experience with the site and the work conducted there is particularly

important for the members of the operations and SME sub-teams and some members of the

management sub-team. Each sub-team should have an experienced sub-team leader for a

combined verification.

For a combined verification, it is recommended the team and review be divided into the following

Functional Areas:

Business, Budget, and Contracts (Phase I)

Hazards Identification and Standards Selection (Phase I & II)

Department of Energy (Phase I & II)

Management (Phase I & II)

Operations and Implementation (Phase II)

Subject Matter Experts (Phase II)

The bulk of the Phase II portion of the verification is assigned to the Operations and

Implementation and Subject Matter Expert sub-teams. Some portion of the DOE and

Management assessment activities are also focused on implementation of the ISMS, although

more of their effort is focused on the Phase I aspect of the verification.

A major challenge to a successful combined verification is development of an effective and

efficient Review Plan. The Review Plan must be developed with a detailed understanding of the

site, facility, or activity. The draft or preliminary plan is normally developed by the Team Leader

or an individual who has been tasked by the Team Leader to prepare the draft Review Plan. The

draft is then further tailored by the individual team members. The development of the draft

Review Plan must occur with full and detailed knowledge of the site, facility, or activity, its

history including recent ORRs and other verifications and with an understanding of the work that

is accomplished, and an understanding of the procedures and processes that are utilized. The

verification must build from the history of the site, facility, or activity and look at the work

involved. The success of the verification will depend in large measure on the effectiveness of the

Review Plan. The draft CRADs for both a Phase I verification and a Phase II verification should

be included in the Review Plan. The CRADs must be tailored to reflect the work, the unique

aspects, and the history of the site, facility, or activity. The CRADs should also be tailored to

remove overlap and redundancy that exists with the CRADs that are designed for stand alone