TABLE OF CONTENTS The Pre-Assessment site visit supports multiple aspects of the NSA INFOSEC Assurance Methodology (IAM). In fact, you might say that it lays the foundation for the entire process. The pre-assessment is where we can work to ensure that the project starts off on the right foot. In this chapter we discuss the goals and objectives you ll pursue during the pre-assessment site visit. See the visit s placement in the overall timeline in Figure 2.1.
The pre-assessment site visit, also referred to as the PASV, should be thought of as a one- to two-day meeting, or three to five days for larger organizations. Your activities will be confined to gathering information through interviews and meetings and facilitating the creation of priorities within the client customer organization. You must plan to take copious notes, ask questions as often as possible, and assist the client in coming to agreement on decisions that can often be very difficult.
One of the best ways to ensure that the project begins well is by managing customer expectations. This may seem like basic common sense. However, you might be surprised at the number of issues that arise due to misunderstanding or miscommunication between the assessing team and the organization. Here we discuss methods of maintaining proper expectations, specific aspects that must be discussed, and several items you should be aware of during your assessment duties.
We must also consider the organization s mission, or business goals. Without full...
