ISMS Phase I Verification Specifics

DOE-HDBK-3027-99

It is not the responsibility of the team to develop the prerequisites but they must understand

them as they reflect the expectations of the Approval Authority. Appendix 4 provides

examples of prerequisites that have proven to be effective.

5.0 Overall Approach: Defines a generic approach by which the review will be conducted,

and provides an introduction to the verification. The Criteria and Review Approach

Documents (CRADs) will be defined by the processes described in this section.

6.0 Preparations: Describes any preparations, including team pre-review site visits,

document reviews, etc., that will be undertaken prior to the on-site review. A discussion of

qualifications and training considerations for team members should appear here.

7.0 Process: Describes the criteria and review approaches that will be used to review the

ISMS. These CRAD should be developed in a format to include the following items:

A. Objective - Identification of the expectation which will be verified as having been

achieved.

B. Criteria - The specifics by which the objectives will be measured, which may include

Approval Authority direction in Phase I, and regulatory requirements.

C. Review Approach - What combination of review of documentation, interviews of

personnel, walkdown of systems, and observations that will be conducted to derive

objective evidence by which the team will measure the defined criteria of the particular

objective or sub-objective.

8.0 Administration: Describes the mechanism for meetings, correspondence,

communications, team structure, etc. of the review. The team composition and organization,

interface requirements, any oversight groups, and DOE organizations to be involved in the

review should be discussed in this section.

9.0 Reporting and Resolutions : Details the methods for preparation and completion of items

identified by the Approval Authority as deliverables at the conclusion of the review.

10.0 Schedule : Presents the proposed schedule for any preparation, pre-review site visits,

on-site review, conduct of review, report preparation, and closeout.

11.0 Appendices : Includes the check lists or other specific evaluation and review documents

which are to be used by the Team Members to conduct the individual assessments. They may

also include reporting forms, writing guides, and other sections appropriate to stand alone in

an appendix. The appendices of this handbook contain information and examples that may be

useful during development of the appendices.

6.3.3 ISMS Phase I Verification Specifics

The primary purpose of the Phase I review is to provide the Approval Authority with a

recommendation for approval of the ISMS Description, showing that the requirements of 48 CFR