## Dclg Must Further Define The Corporate Aims And Outcomes For Information Management In The Department, Ensuring Minimum Compliance With Statutory Requirements. These Aims Need To Continue To Explicitly Support Corporate Outcomes Set Out In The New Departmental Business Plan. 

 
This must be a corporate priority now that the new business plan has been published and should not wait for the outcome of the IT procurement exercise.  
 
 
Prioritisation of outcomes must take in to account what can be realistically achieved by the organisation with the resources allocated to it. 
 

## R1

 
The CIO and SIRO need to assume responsibility for ensuring minimum statutory compliance and support for the implementation of these objectives. 

 
 
DCLG needs to review and reissue its statement concerning its appetite for risk in regard to information assurance as a key underpin to its 
knowledge and information 
Timescale 
R1 Actions 
Priority: High/Low/ Medium 
High 
30/09/13 
DS 
 
 
Action 1.1 Review and refresh the Department"s 
knowledge management strategy in the light of the new business plan 
Medium 
31/03/13 
JK/RW 
 
 
Action 1.2 Agree approach for improving centralised 
knowledge and control of and access to repositories for electronic records 
High 
30/04/13 
DS 
 
 
Action 1.3 Update our risk appetite, using the 
template issued by SCARAB 

## R2 Dclg Needs To Define The Remit And Priorities Of Corporate Records Management Services (Crms). Following Recommendation 1, Crms Needs To Define A Plan, Including Time-Bound Milestones To Ensure Corporate Goals For Information Management Are Reached. Actions Must Be Clearly Defined And The Benefit To The Business Articulated. 

 
The plan must clearly define and prioritise actions according to business need. 
 
 
The plans must identify actions to raise the information management understanding and capability of staff. 
 

| Owner    |
|----------|
| ?        |
| Yes/No   |
|                                                                                                                         | The plan must be accompanied by an implementation plan.                                                                                       |
|-------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                                                        |                                                                                                                                               |
|                                                                                                                         | DCLG and CRMS should consider setting up an internal service standard.                                                                        |
|                                                                                                                        |                                                                                                                                               |
|                                                                                                                         | CRMS and IT must ensure that the CRMS plan is integrated with the IT strategy.                                                                |
|                                                                                                                        |                                                                                                                                               |
|                                                                                                                         | Monitoring of compliance and progress needs to be established and owned at a suitable level within DCLG.                                      |
| Timescale                                                                                                               |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
| R2 Actions                                                                                                              | Priority:                                                                                                                                     |
| High/Low/                                                                                                               |                                                                                                                                               |
| Medium                                                                                                                  |                                                                                                                                               |
| High                                                                                                                    | 28/02/13                                                                                                                                      |
| Action 2.1                                                                                                              |                                                                                                                                               |
| Prepare IMA Action plan and commence                                                                                    |                                                                                                                                               |
| implementation                                                                                                          |                                                                                                                                               |
| DCLG needs to define appropriate metrics and monitor progress against information management outcomes                   |                                                                                                                                               |
| (according to corporate priorities                                                                                      |                                                                                                                                               |
| in recommendations 1 and 2) if it is to drive positive change throughout DCLG.                                          |                                                                                                                                               |
|                                                                                                                        |                                                                                                                                               |
|                                                                                                                         | This should include performance against mailbox and personal drive reduction targets, AFP usage and the application of retention in corporate |
| repositories.                                                                                                           |                                                                                                                                               |
|                                                                                                                        |                                                                                                                                               |
|                                                                                                                         | Monitoring of performance should be the responsibility of the DRO, escalated to the CIO and SIRO when necessary.                              |
|                                                                                                                         |                                                                                                                                               |
| R3                                                                                                                      |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
| Timescale                                                                                                               |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
| R3 Actions                                                                                                              | Priority                                                                                                                                      |
| High/Low/                                                                                                               |                                                                                                                                               |
| Medium                                                                                                                  |                                                                                                                                               |
| High                                                                                                                    | 31/01/13                                                                                                                                      |
| Action 3.1                                                                                                              |                                                                                                                                               |
| Monitor mailboxes on a monthly basis,                                                                                   |                                                                                                                                               |
| circulating to CIO and SIRO as necessary                                                                                |                                                                                                                                               |
| Action 3.2                                                                                                              |                                                                                                                                               |
| Identify ownership of drives across the                                                                                 |                                                                                                                                               |
| Department, and data orphaned by structural changes                                                                     |                                                                                                                                               |
| High                                                                                                                    | Quarter 1                                                                                                                                     |
| 2013                                                                                                                    |                                                                                                                                               |
| Medium                                                                                                                  | 31/03/13                                                                                                                                      |
| Action 3.3                                                                                                              |                                                                                                                                               |
| Liaise with IT to ensure that P drive                                                                                   |                                                                                                                                               |
| recycle bins are automatically deleted                                                                                  |                                                                                                                                               |
| Action 3.4                                                                                                              |                                                                                                                                               |
| Initiate a strategy for P: drives                                                                                       |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
| Medium                                                                                                                  | Quarter 2                                                                                                                                     |
| 2013                                                                                                                    |                                                                                                                                               |
| DCLG needs to ensure that management promotes and monitors compliance with corporate policy for information management. |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
|                                                                                                                        |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
| R4                                                                                                                      |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
|                                                                                                                         |                                                                                                                                               |
|                                                                                                                         | DCLG needs to monitor non-compliance with policy and define appropriate sanctions.                                                            |
| Owner    | Observations    | Delivered   |
|----------|-----------------|-------------|
| ?        |                 |             |
| Yes/No   |                 |             |
| Owner    | Observations    | Delivered   |
| ?        |                 |             |
| Yes/No   |                 |             |
| JK/RW/AP |                 |             |
| JK/AP    |                 |             |
 
 
Where technically possible, CRMS must be given appropriate permissions to access divisional drives to allow oversight of compliance with policy. 
  
 
The SIRO and CIO need to establish formal lines of communication to ensure that information management risks are visible and easily escalated. 
Timescale 
R4 Actions 
Priority High/Low/ Medium 
Action 4.1 See action 3.2 


High 
Quarter 1 2013 
Action 4.2 Prepare policy on deletion processes and 
use as springboard to highlight need to follow RM procedures for electronic records 
Action 4.3 Conduct assessment against IAMM 
Low 
2013 
AP/DS 
 
 
CRMS must ensure that policies and guidance are aligned with the corporate priorities for information management (as defined by DCLG in 
recommendation 1). 
 
Policies need to be accompanied by an implementation plan based on DCLG prioritisation. 
 
 
As a matter of urgency, DCLG should create and distribute easy to use guidance based on the fundamental information management priorities. 
  
 
The head of Knowledge and information Access needs to continue to provide specific policy and guidance on: R5 
o 
FOIA and the application of exemptions as these develop 
Timescale 
R5 Actions 
Priority High/Low/ Medium 
High 
28/02/2013 
AP 
 
 
Action 5.1 Redesign intranet pages to provide "easy 
to use guidance" and promote these across 
Department 
Medium 
Ongoing 
MC 
 
 
Action 5.2 KIA to monitor any changes to legislative 
framework and update guidance accordingly 


| Owner    | Observations    | Delivered   |
|----------|-----------------|-------------|
| ?        |                 |             |
| Yes/No   |                 |             |
| AP       |                 |             |
| Owner    | Observations    | Delivered   |
| ?        |                 |             |
| Yes/No   |                 |             |

## Dclg Needs To Understand The Information That It Holds, Where It Is Stored And How It Needs To Be Used. This Will Support The Department In Identifying How Information Needs To Be Managed In Order To Ensure Statutory Compliance. 

 
DCLG needs to agree ownership and responsibility for maintaining the departmental and Divisional Information Asset Registers (IARs) and how they will be used to inform risk and management decisions. 

 

## R6

 
CRMS, with the support of the CIO and SIRO, needs to ensure that Divisions are actively engaging in the process of recording the information that it creates and holds. DCLG also needs to continue to define what its key information assets are, where they are stored and how they need to be managed. 

 
 
DCLG should work with The National Archives to ensure that maximum benefit can be gained from its IAR ahead of the forthcoming ICT re-let. 
This includes increasing understanding of technological dependencies and usability requirements. 
 
 
DCLG needs to develop a clear strategy for aligning its current Information Asset Register into wider Government data and information 
reviews, such as the forthcoming Data Inventory, ensuring all information assets are accounted for. 
Timescale 
R6 Actions 
Priority High/Low/ Medium 
High 
31/01/13 
DS/AP 
 
 
Action 6.1 Embed annual updates to the information 
asset register into the sign-off of the annual governance statement 
Action 6.2 Liaise with Open Data colleagues and 
Cabinet Office to feed into development of data inventory if appropriate 
Low 
Cabinet Office to advise 
Medium 
30/06/2013 
AP 
 
 
Action 6.3 Refresh Information Asset Register in light 
of new Government Classification Scheme and identify any concerns arising from the IT re-let 


CRMS must implement its action plan to ensure compliance with the 20 year rule change. 

## R7

 
DCLG needs to ensure it has comprehensively planned its resource allocation to cope with the increased volume of review required for both 

## 

| Owner    | Observations    | Delivered   |
|----------|-----------------|-------------|
| ?        |                 |             |
| Yes/No   |                 |             |
| AP       |                 |             |
DCLG and Department for Transport (DfT). 
Timescale 
R7 Actions 
Priority High/Low/ Medium 
High 
Every quarter 
DD 
Action 7.1 Produce implementation plan and review  
quarterly 
Medium 
Every quarter 
DD 
 
 
Action 7.2 Review progress on quarterly basis and 
report to DRO/TNA 
Medium 
Every quarter 
DD 
 
 
Action 7.3 Highlight challenges and risks and update  
quarterly 
Medium 
Every quarter 
DD 
 
 
Action 7.4 Identify key events likely to be of 
significant historical importance and target resources 
accordingly   
CRMS needs to ensure compliance with What To Keep and retention schedules in conjunction with Divisions to ensure that DCLG is capturing 
the records that it requires and that these are retained and destroyed in line with statutory obligations. 
 
Senior level ownership for specific legislative compliance should be defined. 
 
 
DCLG must evaluate the full range of its legislative obligations and define minimum measures for compliance with these. 
  R8 
 
DCLG needs to ensure that staff are aware of available guidance. Managers need to be aware of their responsibilities to promote and ensure compliance with policy and legislation 
 
 
DCLG would benefit from using a reinvigorated Business Records Officer (BRO) network to champion and encourage good practice in this 
regard. 
Timescale 
R8 Actions 
Priority High/Low/ Medium 
Medium 
Quarter 2 2013 
Action 8.1 Refresh and re-circulate the "What to 
keep" guidance to the BRO network once reestablished 
High 
31/03/13 
AP 
 
 
Action 8.2 Launch new intranet pages with 
communications to all BROs highlighting 
| Owner    | Observations    | Delivered   |
|----------|-----------------|-------------|
| ?        |                 |             |
| Yes/No   |                 |             |
| Owner    | Observations    | Delivered   |
| ?        |                 |             |
| Yes/No   |                 |             |
| AP       |                 |             |
| High                                                                                                                                   | 31/03/13                                                                                                        | AP/JK/DS    |     |     |
|----------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|-------------|-----|-----|
| responsibilities etc.                                                                                                                  |                                                                                                                 |             |     |     |
| Action 8.3                                                                                                                             |                                                                                                                 |             |     |     |
| Develop a deletion policy to sit alongside                                                                                             |                                                                                                                 |             |     |     |
| retention policy, outlining when information should be                                                                                 |                                                                                                                 |             |     |     |
| considered "destroyed"                                                                                                                 |                                                                                                                 |             |     |     |
| High                                                                                                                                   | Quarter 1                                                                                                       |             |     |     |
| 2013                                                                                                                                   |                                                                                                                 |             |     |     |
| Action 8.4                                                                                                                             |                                                                                                                 |             |     |     |
| Develop a plan for the introduction of new                                                                                             |                                                                                                                 |             |     |     |
| ASDs across the Department, incorporating any                                                                                          |                                                                                                                 |             |     |     |
| requirements arising from the IT re-let                                                                                                |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
| DCLG must reduce the personal size limit for email to levels congruent with other government departments. Use of personal drives must  |                                                                                                                 |             |     |     |
| also be addressed.                                                                                                                    |                                                                                                                 |             |     |     |
|                                                                                                                                        | A phased reduction is required with individual targets linked to the migration to the new IT re-let schedule.  |             |     |     |
|                                                                                                                                        | Corporate targets must be decided and monitored by CIO, SIRO and DRO.                                           |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
| Timescale                                                                                                                              |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
| R9 Actions                                                                                                                             | Priority                                                                                                        |             |     |     |
| High/Low/                                                                                                                              |                                                                                                                 |             |     |     |
| Medium                                                                                                                                 |                                                                                                                 |             |     |     |
| High                                                                                                                                   | 31/12/12                                                                                                        | DS          |     | Yes |
|                                                                                                                                        |                                                                                                                 |             |     |     |
| R9                                                                                                                                     |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
| Action 9.1                                                                                                                             |                                                                                                                 |             |     |     |
| Agree targets for reduction of mailboxes                                                                                               |                                                                                                                 |             |     |     |
| with CIO                                                                                                                               |                                                                                                                 |             |     |     |
| High                                                                                                                                   | 31/03/13                                                                                                        | AP/JK/DS    |     |     |
| Action 9.2                                                                                                                             |                                                                                                                 |             |     |     |
| Plan and instigate communications                                                                                                      |                                                                                                                 |             |     |     |
| regarding mailbox reduction                                                                                                            |                                                                                                                 |             |     |     |
| Action 9.3                                                                                                                             |                                                                                                                 |             |     |     |
| Reduce mailboxes across the Department                                                                                                 |                                                                                                                 |             |     |     |
| to 500MB                                                                                                                               |                                                                                                                 |             |     |     |
| High                                                                                                                                   | Commence                                                                                                        |             |     |     |
| by 31/03/13                                                                                                                            |                                                                                                                 |             |     |     |
| Medium                                                                                                                                 | 31/03/13                                                                                                        | AP          |     |     |
| Action 9.4                                                                                                                             |                                                                                                                 |             |     |     |
| Provide Livelink to ministerial teams to                                                                                               |                                                                                                                 |             |     |     |
| enable them to reduce their mailboxes to more                                                                                          |                                                                                                                 |             |     |     |
| manageable levels                                                                                                                      |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
| Timescale                                                                                                                              |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
| DCLG needs to ensure that the action taken to review and dispose of digital information is fully risk-assessed against compliance with |                                                                                                                 |             |     |     |
| legislative and business requirements.                                                                                                 |                                                                                                                 |             |     |     |
| This is because retrospective application of retention raises the risk that of deleting records and information                        |                                                                                                                 |             |     |     |
| that retain value to the organisation or as a public record.                                                                           |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
| R10 Actions                                                                                                                            | Priority                                                                                                        |             |     |     |
| High/Low/                                                                                                                              |                                                                                                                 |             |     |     |
| Medium                                                                                                                                 |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
| R10                                                                                                                                    |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
|                                                                                                                                        |                                                                                                                 |             |     |     |
| Action 10.1                                                                                                                            |                                                                                                                 |             |     |     |
|                                                                                                                                        | Develop a policy on the lifecycle                                                                               |             |     |     |
| management of electronic records and how that policy                                                                                   |                                                                                                                 |             |     |     |
| High                                                                                                                                   | Quarter 1                                                                                                       |             |     |     |
| 2013                                                                                                                                   |                                                                                                                 |             |     |     |
| JK/RW    |              |           |
|----------|--------------|-----------|
| Owner    | Observations | Delivered |
| ?        |              |           |
| Yes/No   |              |           |
| AP/JK/DS |              |           |
| Owner    | Observations | Delivered |
| ?        |              |           |
| Yes/No   |              |           |
| JK/RW    |              |           |
can be implemented. 
Action 10.2 Review the above policy before 
completion to ensure it meets legislative and business requirements. 
DCLG must ensure that all technology change projects meet its information requirements. 
 
DCLG needs to develop a strategy for managing Digital Continuity. 
 
 
DCLG needs to ensure that information requirements are central to all technology change planning and projects, through the adoption of formal structures such as a technology change board. The National Archives Digital continuity guidance will support the department as it embeds good practice in to policies and processes. 
  R11 
 
CRMS and IT must continue to run the digital continuity self assessment tool based on future electronic records held in Nearline Network Attached Storage and those held by TNT storage, and take appropriate mitigating action where risk is identified. 
Timescale 
R11 Actions 
Priority High/Low/ Medium 
Action 11.1 Establish liaison role with IT team 
High 
31/03/13 
AP/JK 
 
 
High 
31/01/13 
DS 
 
Yes 
Action 11.2 Ensure that RM requirements are 
embedded in IT re-let project plans 


Timescale 
DCLG should take the opportunity to consider information security requirements ahead of the IT re-let with particular regard to striking the right balance between protecting and sharing information. R12 Actions 
Priority High/Low/ Medium 
Action 12.1 See 1.3 - risk appetite R12 
Action 12.2 Embed new Government Classification 
Scheme across Department 
Medium 
30/06/13 or as set by Cabinet 
| Owner    | Observations    | Delivered   |
|----------|-----------------|-------------|
| ?        |                 |             |
| Yes/No   |                 |             |
| Owner    | Observations    | Delivered   |
| ?        |                 |             |
| Yes/No   |                 |             |
| DS/AP    |                 |             |

## Dclg Should Re-Invigorate The Network Of Effective Business Records Officers (Bros) With Sufficient Coverage, Appropriate Delegation Of Authority, Training And Monitoring. This Will Enable Dclg To Disseminate Best Practice And Drive Compliance, To Ensure A Minimum Standard Of Consistent Good Practice In Order To Meet Minimum Statutory Requirements, Including Compliance With The Public Record Act, Freedom Of Information Act And The Data Protection Act.

 
CRMS need to engage with BROs to create local What to Keep schedules for Divisions. These must be reviewed regularly. 
 
DCLG must ensure that the BRO network is maintained. CRMS needs to provide leadership and direction and coordinate activities. 
|                                                   | CRMS must provide updated guidance and training for the role. CRMS should also take a lead in sharing and disseminating good practice.   |
|---------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
|                                                   |                                                                                                                                          |
| Timescale                                         |                                                                                                                                          |
|                                                   |                                                                                                                                          |
| Actions                                           | Priority                                                                                                                                 |
| High/Low/                                         |                                                                                                                                          |
| Medium                                            |                                                                                                                                          |
| High                                              | 28/02/13                                                                                                                                 |
| Action 13.1                                       |                                                                                                                                          |
| Establish single up-to-date list of current       |                                                                                                                                          |
| BROs, filling in gaps resulting from restructure  |                                                                                                                                          |
| Medium                                            | 31/03/13                                                                                                                                 |
| Action 13.2                                       |                                                                                                                                          |
| Refresh guidance documents available to           |                                                                                                                                          |
| BROs to reflect the current needs for their role  |                                                                                                                                          |
| High                                              | 30/09/13                                                                                                                                 |
| Action 13.3                                       |                                                                                                                                          |
| Build BRO responsibilities into any new           |                                                                                                                                          |
| technology and into the managed service under the |                                                                                                                                          |
| new IT contractor                                 |                                                                                                                                          |


| Owner    |
|----------|
| ?        |
| Yes/No   |