Report - hdbk3027990094

DOE-HDBK-3027-99

verification, one week is considered adequate. This period is considered essential to ensure a

quality report is prepared on site before the team is released.

(5) Report. A report similar in form to an ORR Report was drafted to document the team

findings. No Form Deficiency Forms (Form 2) were used. Issues, where identified, were

highlighted in the Assessment Form. Only Assessment Forms (Form 1) were used. This worked

well. Categorizing problems in the form of "Issues," "Concerns," and "Observations" may be

useful.

(6) General Recommendations

a. The establishment of a site-wide ISMS Description provides the optimum opportunity for

an ISMS verification team to fully evaluate an ISMS baseline. Where it is possible to conduct

ISMS reviews on a site-wide basis, this option should be exercised. Other approaches

(facility or activity reviews) while not restricted by policy, may be more difficult to administer

and evaluate and less efficient.

b. The ISMS verification is normally conducted in two phases. Phase I involves a review of

the ISMS Description including enabling documents and processes. Phase II involves the

acceptability of the ISMS implementation. A review of the documentation without

consideration of the implementation process is not a totally worthwhile exercise. It is

considered necessary that a review of any ISMS Description include the implementation of

that ISMS at least at the corporate or division level.

c. When tasked to conduct a two-phase review, it is important to ensure that issues affecting

implementation are appropriately relegated to Phase II. It is appropriate to provide

implementation issues to the contractor informally; however, these issues should not be made

a part of Phase I. At SRS, the ISMS was reported as implemented. During the Phase I

Review, implementation issues were routinely developed and required some rethinking to

categorize them correctly.

d. The contractor should develop and provide the ISMS verification team with key

summarized information that assists in the evaluation of the core functions and guiding

principles. Examples are:

C calendars of ISMS related events and work evolutions

C a key document locator reference

C site maps and facility layouts

C ISMS mechanism/process flow diagrams and descriptions

C organization charts, phone/fax/e-mail lists

C key roles and responsibilities at each level of the organization

A-5-10