Action plan progress review Ministry of Justice (MoJ) 

## Contents

 
Background and action plan development  
  
 
 03  
Summary of progress since the IMA  

04 
Next steps 
 
  

07 

 
© Crown copyright 2017. You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0. Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Background The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management. The Ministry of Justice (MoJ) IMA took place in May 2016. This progress review summarises key developments since the IMA. Areas where continued attention is still needed are listed below under 'Next Steps.' 
Action plan development 
 
MoJ promptly produced a detailed action plan following the IMA and the Knowledge and Information Management team discussed progress against the recommendations with its Deputy Director. The National Archives formally assessed progress against the action plan in November 2017. The IMA report and updated action plan are both published on The National Archives' website.1 

## Summary Of Progress Since The Ima 1 The Value Of Information

| Performance rating    | IMA 2016            |
|-----------------------|---------------------|
| Communicating and     |                     |
| realising value       |                     |
| Development area      | Progressing towards |
| satisfactory          |                     |
| Managing information  |                     |
| as an asset           |                     |
| Satisfactory          | Progressing towards |
| good                  |                     |

## Recommendations: 1, 2 And 3

 The Ministry of Justice (MoJ) has now developed an Information Management 
Strategy, a key gap identified at the time of the IMA. This was approved by the Information Risk and Security Board in July 2017. It is now being aligned with MoJ's digital strategy and is also tied in with the department's approach to 
implementing the General Data Protection Regulation (GDPR). **See next steps** 
 MoJ has continued to develop and embed its approach to managing its 
information assets including reviewing and updating guidance, training and the Information Asset Register template. Information assurance roles have been reviewed to ensure that the right personnel continue to be in place to support this work.  

## 2 Digital Information And Supporting Technology

| Performance rating        | IMA 2016            |
|---------------------------|---------------------|
| Supporting information    |                     |
| through technology        |                     |
| Development area          | Progressing towards |
| satisfactory              |                     |
| Digital continuity and IT |                     |
| change                    |                     |
| Development area          | Progressing towards |
| satisfactory              |                     |

## Recommendations: 4

 The rollout of Just Store (MoJ's new system for managing digital records 
throughout their lifecycle) was completed in April 2017. Feedback has been positive and other teams, outside the core rollout group, are asking if they can have the system as well. 
 The Knowledge and Information Management (KIM) team are working closely 
with Digital Technology on the rollout of Office 365 and SharePoint Online to ensure that information and records management requirements are taken into account. This has included a phased approach to the rollout of SharePoint 
Online and piloting RecordPoint to enable disposal in SharePoint Online. See next steps 
 Options are being explored to gain greater oversight of and to better manage 
information on shared drives, including looking at several ediscovery/analytical tools. Technology have also begun the Arc project to freeze shared drives and identify redundant or trivial material that can be 
disposed of before migrating to Office 365. **See next steps** 

## 3 Information Risk, Governance And Oversight

| Performance rating       | IMA 2016         | Review 2017      |
|--------------------------|------------------|------------------|
| Good practice            | Good practice    | Recognising      |
| information risk         |                  |                  |
| Establishing control     | Satisfactory     | Satisfactory     |
| Providing guidance       | Good practice    | Good practice    |
| Measuring impact         | Development area | Development area |
| Recommendations: 2, 3, 5 |                  |                  |

 MoJ continues with its good practice approach to recognising and managing 
information risk. The Senior Information Risk Owner (SIRO) Board has been renamed the Information Risk and Security (IRS) Board and a restructure was agreed in summer 2017. As recommended, cyber security risks are now 
included on the IRS information risk register. Descriptions of information management related risks are continuing to evolve in a way that reflects the changing IT environment, including the introduction of Just Store. The 
department's active approach is underlined by the identification of a new risk 
relating to the accessibility of online tools. Information Assurance Leads have now been moved from functional business areas into a central team to enable closer collaboration. Guidance and training includes information on the various information assurance roles to improve awareness and understanding of these.  
 Now the roll out of Just Store is complete, the KIM Champion role is to be 
discontinued. Responsibility for championing information and records 
management in business areas will sit with Information Asset Owners. See next steps 
 Rollout of Just Store was supported by a comprehensive package of training 
and guidance and use has been promoted by senior staff including directors and KIM Champions which addresses concerns about maintaining senior level backing for work to drive information management culture. Guidance on 
what to keep was revised and published as part of the 'Spring Clean Your 
Information' campaign in May 2017 and MoJ has continued to ensure that retention schedules are published in line with recommendations in Sir Alex 
Allan's 2014 report, *Records Review*. Work has started to review and update all guidance to reflect new IT environment and GDPR. 
 MoJ is yet to develop a process for monitoring compliance with information 
management policy. **See next steps** 

## 4 Records, Review And Transfer

| Performance rating    | IMA 2015     | Review 2017           |
|-----------------------|--------------|-----------------------|
| Satisfactory          | Satisfactory | Oversight of records  |
| and selection         |              |                       |
| Satisfactory          | Satisfactory | Implementing disposal |
| decisions             |              |                       |
| Recommendations: 6    |              |                       |

 MoJ has maintained progress with paper review and is planning ahead to 
ensure that it continues to keep pace with the transition to the 20 Year Rule. Work has included ascertaining how much paper there is to process in the 
next five years, looking at ways of speeding up the appraisal process and making a business case for extra staff. **See next steps** 

 As recommended, MoJ is in the process of enabling use of DROID (The 
National Archives' file profiling tool) to facilitate the transfer of digital information to The National Archives. 
 Work to appraise material on the shared drives will be progressed once the 
work to roll out Office 365 is complete (see also section 2) and the team is aiming to reuse the process/principals that it established for appraisal and selection of material on TRIM (MoJ's original system for managing digital 
records) and Just Store. **See next steps** 
 As of yet MoJ has not established a process for the sensitivity review of digital 
information. **See next steps** 

## Next Steps

The National Archives will continue to support the Ministry of Justice in its work on information and records management so that it is supported through to the time of its next IMA. In the interim, we recommend that the following points are focussed on and built into departmental business planning: 

 Launch the Information Management Strategy and develop a process for 
reporting on implementation of the strategy to the senior team and an opportunity for the team to scrutinise progress, via the Information Risk and Security (IRS) Board 
 Ensure that guidance and training for Information Asset Owners includes 
responsibilities for information management, for example, promoting messages around knowledge, information and records management and ensuring that staff are complying with information management policy. Emphasise that this is a core requirement of the role that supports wider information assurance considerations. 
 Ongoing work with digital technology on ensuring that systems adequately 
support information and records management including managing email within the Office 365 environment, implementing disposal, statistics on usage of systems and the shared drive project. 
 Develop a process of monitoring compliance with information management 
policy drawing on good practice examples such as HM Treasury. 
 Seek to develop a process for sensitivity review of digital records drawing on 
work carried out by The National Archives and other government departments. 
 Ensure that a digital continuity plan is in place for digital records inherited from 
inquests/inquiries. 
 Continue to explore ways of streamlining the process of appraisal and selection 
of paper records and ensuring that this also feeds into process for future digital appraisal and selection. This will be particularly important if the business case to get extra staff is unsuccessful.  
 Consider using DROID to identify digital continuity risks (for example, age, 
format of digital holdings) and to track how these are being mitigated through the IRS information risk register.