Preparation for any activity is the key to a successful project. After completion of the pre-assessment site visit, ideally the assessment team will have the opportunity to go back to home base to prepare for the onsite activities. The pre-assessment preparation activities are expected to take two to four weeks, to allow time to conduct all the activities. Both the assessment team and the customer will have preparation activities they must accomplish in order to be prepared for the actual onsite time. These activities involve both administrative and technical activities to ensure that the onsite phase will go smoothly. Appropriate formulation of the interview schedule is probably the most critical preparation activity, making sure that the proper amounts of time for activities are coordinated.

Once the preparation is complete, it is important to think about the flow of the onsite phase of the IAM. The important first step is the opening meeting, which is the first opportunity to make a positive impression during the onsite phase. The opening meeting should reiterate the agreed-on assessment plan, identify the current schedule, show the benefits of the assessment process, and help establish expectations for the remainder of the assessment. A positive first impression is essential to assessment success. During the assessment process, understand the importance of keeping both the customer and the assessment team informed of progress and remaining actions.

The NSA 18 Baseline INFOSEC Classes and Categories provides an excellent framework to focus the onsite information collection activities. These 18 categories...