## Annex B - Dcms Ima Action Plan 1 Department For Culture, Media And Sport (Dcms) Should Continue To Improve Its Approach To Information Risk And Information Asset Management.

Initial DRO commentary post IMA on the starting point with each action area. Commentary last updated: December 2017 

|  Enabling/supporting actions               | Owner                                | Commentary on progress    |
|--------------------------------------------|--------------------------------------|---------------------------|
| due                                        |                                      |                           |
| Status                                     |                                      |                           |
|                                            |                                      |                           |
| -                                          |                                      |                           |
|                                            |                                      |                           |
| 1.1 Identifying risks that reflect the     | -                                    |                           |
|                                            |                                      |                           |
| To work with DCMS IT lead on developing    |                                      |                           |
|                                            |                                      |                           |
| DRO                                        |                                      |                           |
|                                            |                                      |                           |
|                                            |                                      |                           |
| March 2018                                 |                                      |                           |
|                                            |                                      |                           |
|                                            |                                      |                           |
| Active                                     |                                      |                           |
| the Information Asset Register (IAR) to    |                                      |                           |
| understand the extent to which information |                                      |                           |
| is stored outside of Google Drive and to   |                                      |                           |
| ensure that there are appropriate digital  |                                      |                           |
| arrangements set out in the IAR.           |                                      |                           |
| -                                          |                                      |                           |
|                                            |                                      |                           |
| To liaise with OGDs (including Cabinet     |                                      |                           |
| potential impact of not capturing and      |                                      |                           |
| keeping information appropriately -        |                                      |                           |
| both in terms of limitations of the        |                                      |                           |
| Google environment and cultural factors    |                                      |                           |
| - and risks around the loss of digital     |                                      |                           |
| continuity and usability of information.   |                                      |                           |
| Ensure that these are documented and       |                                      |                           |
| owned at an appropriate level to drive     |                                      |                           |
| action.                                    |                                      |                           |
| Office) that use the G-Suite to understand |                                      |                           |
| the processes Departments have in place to |                                      |                           |
| mitigate the risks of not capturing        |                                      |                           |
| information effectively.                   |                                      |                           |
| -                                          |                                      |                           |
|                                            |                                      |                           |
| 1.2 Learn from departments which have      | DRO                                  | -                         |
|                                            |                                      |                           |
| DRO met with MoJ and HO as they have       |                                      |                           |
| Active                                     | well defined information and records |                           |
| management risks.                          |                                      |                           |
|                                            |                                      |                           |
| December                                   |                                      |                           |
| 2017                                       |                                      |                           |
| been identified by TNA as demonstrating    |                                      |                           |
| good practice in this area and feedback    |                                      |                           |
| recommendations to KIMIT.                  |                                      |                           |
| -                                          |                                      |                           |
|                                            |                                      |                           |
| Further meetings were conducted with       |                                      |                           |
| Northern Ireland Office and HM Treasury as |                                      |                           |
| a similar sized department.                |                                      |                           |
| -                                          |                                      |                           |
|                                            |                                      |                           |
| 1.3 Arrange a board briefing from The      | -                                    |                           |
|                                            |                                      |                           |
| To recommend to KIMIT at its July meeting  |                                      |                           |
| December 17                                |                                      |                           |
|                                            |                                      |                           |
|                                            |                                      |                           |
| DRO                                        |                                      |                           |
| that it (or EB as appropriate) receive a   |                                      |                           |
| briefing on Information Assurance.         |                                      |                           |
|                                            |                                      |                           |
|                                            |                                      |                           |
| Active                                     |                                      |                           |
| National Archives on information           |                                      |                           |
| assurance and risk to help increase        |                                      |                           |
| awareness at a senior level.               | -                                    |                           |
|                                            |                                      |                           |
| To be part of CE/Keeper - PS meeting on 18 |                                      |                           |
| Dec 17 (Rescheduled for 9 Jan 18)          |                                      |                           |
 
- 1.4 Increase awareness of the 
DRO 
- Meetings and training sessions with March 2018 Active 
Information Asset Owners (IAO) in each business area are ongoing and being updated to cover DP Bill compliance work .  
Information Asset Owner (IAO) role across the department, among those that hold the IAO role and DCMS staff 
more generally. 
- Liaison with internal Comms Team to  
refresh key KIM areas on the intranet for Information Assurance and Data Protection guidance.  
December 2017 
Active 
- 1.5 Ensure that IAOs are appointed at an 
DRO 
- Organisational chart show DCMS SCS staff 
appropriate level and have a clear idea of their responsibilities. 
are aware of their responsibilities but staff education is an ongoing task as an IAO must consider which Information Assets it needs to record in the IAR, what has business value 
and where personal data is held. 
March 2018 
Complete 
- 1.6 Produce guidance and training to 
 
- IAO guidance including a job description and 
support IAOs in their role and using The National Archives' 'Train the Trainer' materials to help with this.  
guidance on completing the IAR has been produced and recently updated.  Further updates will continue to reflect changes for the DP Bill compliance. This will be published internally and continuous updates as the department progresses towards DP Bill compliance in May 18 to ensure it meets the requirements of GDPR. 
Active 
- 1.7 Develop an approach to identify and 
DRO 
- As at 1.6 the guidance on IAR including a 
December 2017 
definition of an Information Asset and the role of IAO is completed.  
- The profile of Information Assurance is being 
record information assets that is proportionate and enables DCMS to get oversight of these assets, in particular those that are sensitive or of high value (explore good practice with OGDs). 
raised. The training sessions with IAOs and publication of this guidance on the intranet will help to address this.  
Active 
- 1.8 Explore good practice in information 
DRO 
- DRO to arrange meetings with DWP to 
understand its Information Asset governance 
December 2017 
asset governance in other government departments. 
 
arrangements as held up by TNA as an exemplar of good practice. 

## 2 Dcms Should Continue Work To Promote And Maintain A Good Culture Of Information And Records Management Across The Department.

Initial DRO commentary post IMA on the starting point with each action area. Commentary last updated: December 2017 
 
Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
Ongoing  
Active 
- 2.1 Use KIMIT and the Records 
DRO 
- The DRO continues to liaise with OGDs that 
Management, IT and Knowledge 
Strategies to drive work on improving information and records management culture. 
use the G-Suite (and AODocs) to ensure that 
the Department's Records Management policy is aligned, learning and contributing to best practice. The updated policy was submitted to KIMIT for consideration at its October meeting and agreed. 
March 2018 
Active 
- 2.2 Update the records management 
DRO 
- To liaise with HR and the SCS Knowledge 
Champion to map the best way of inducting staff to the department in terms of their information obligations.  
- Thereafter to develop training, guidance as 
policy and associated guidance, ensuring that it clearly sets out the responsibilities of staff for managing their information and records within the new IT environment.  
appropriate, other solution as appropriate. 
 
Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
Ongoing 
Active 
- 2.3 Incorporate information and records 
DRO 
- The DRO has established a schedule of new 
teams to brief on Information Asset obligations, AODocs library structure 
management as part of the Management Framework to encourage managers to promote and drive good practice. 

## 

 
management and appointment of Knowledge Champions. 
- A continuing process of information 
assurance as well as good records 
management education continues. 
Ongoing 
Active 
- 2.4 Work with business areas to ensure 
DRO 
- Arrange meetings with the Houses of 
that information and records management is included as part of induction for new staff.  
Parliament and Home Office who have produced e-learning courses to introduce staff to their information and records management responsibilities.   
- Develop a solution appropriate to DCMS. 
March 2018 
Active 
- 2.5 Build on the work DCMS is already 
DRO 
- To work with DCMS IT lead and Comms team 
doing to provide training for staff in 
information and records management. This could include e-learning. 
to consider developing some form of online 
training (induction) package for staff. Further promote AODocs online training videos. 
- Induction continues to mature within DCMS, 
with both records and information security featuring as part of the induction pack. 
Ongoing 
Active 
- 2.6 Explore and adopt cross government 
DRO 
- The DRO utilises the cross government 
toolkit (available on the Knowledge Hub) to improve departmental culture.  
toolkit and relevant components to enhance DCMS records and information culture as appropriate. 
March 2018 
Active 
- 2.7 Promote the Knowledge and 
- To further develop the Department's KIM 
SCS Knowledge Champion 
Information Management (KIM) message to mitigate risks that arise from machinery of government change and changes in personnel. 
maturity through the delivery of the Department's Knowledge Management Strategy (early 2018) and thereafter through the work of the business unit level Knowledge Management Champions network. 
- A new SCS KIM Champion is now firmly in 
place to take this initiative forward. 
 
Ongoing 
Active 
- 2.8 Engage with new teams to ensure 
DRO 
- Meet with new Deputy Directors to explain 
information management requirements are identified from the outset. 
their roles as IAOs and to arrange separate records management briefings at team meetings. (Aligned with 1.4) 
Active 
- 2.9 Highlight the importance of 
DRO 
- DCMS Operational Selection Policy (OSP) has 
December 2017 
information from an historic and business point of view in order for it to resonate with staff. A good example is HM Treasury creating videos for its intranet on the history of its records. 
passed through TNA assessment and has been published for comment by the wider academic community. It acts as the definitive guide (resource) to the department's work since its creation from the Department of National Heritage in 1992. 
- To publish a series of blogs on departmental 
records that have been selected for 
preservation (as the transfer programme matures and records of archival value continue to be selected for preservation). 
Ongoing 
Active 
- 2.10 Identify a means to engage all SCS 
DRO 
- This action will form part of work to engage 
with SCS members about their roles as IAOs. 
staff - not just those that are members of the KIMIT. 


## 3 Dcms Needs To Ensure That Its Technology Environment Supports Legislative And Business Requirements For Managing Digital Information And Records And Mitigate Risks Where This Is Not Possible.

Initial DRO commentary post IMA on the starting point with each action area. Commentary last updated: December 2017 
 

| Enabling/supporting actions                    | Owner    | Commentary on progress    |
|------------------------------------------------|----------|---------------------------|
| due                                            |          |                           |
| Status                                         |          |                           |
|                                                |          |                           |
| Ongoing                                        | Active   | -                         |
|                                                |          |                           |
| 3.1 Ensure that requirements around            | -        |                           |
|                                                |          |                           |
| Monthly alignment meetings with THE DCMS       |          |                           |
| DCMS IT Lead                                   |          |                           |
| and DRO                                        |          |                           |
| IT lead established.  Records requirements     |          |                           |
| now embedded in the IT Programme and an        |          |                           |
| integral part of the new IT Strategy for 2018. |          |                           |
| information and records management             |          |                           |
| form a core part of work to review and         |          |                           |
| define the service provided by Cabinet         |          |                           |
| Office as IT provider.                         | -        |                           |
|                                                |          |                           |
| Meetings already established with Cabinet      |          |                           |
| Office DRO to understand the latest progress   |          |                           |
| with information and records management        |          |                           |
| in that department.                            |          |                           |
| Ongoing                                        | Active   | -                         |
|                                                |          |                           |
| 3.2 Work with Cabinet Office and outside       |          | -                         |
|                                                |          |                           |
| DRO has begun work on a 'Records Lifecycle     |          |                           |
| Management in DCMS' policy document and        |          |                           |
| is working with TNA and Cabinet Office to      |          |                           |
| develop this policy.                           |          |                           |
| companies such as AODocs to address            |          |                           |
| gaps in the Google environment, in             |          |                           |
| particular around retention and disposal       |          |                           |
| and the management of email.                   | -        |                           |
|                                                |          |                           |
| The DRO is a member of the cross               |          |                           |
| government Google Group which discusses        |          |                           |
| desired enhancements to G-Suite.               |          |                           |
 
Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
Ongoing 
Active 
- 3.3 Keep pace with developments and 
- The DRO is a member of the cross DRO 
government Google Group which discusses 
desired enhancements to G-Suite. 
 
sharing its own knowledge and 
experience of the tools as part of the cross-government Google working group. 
 
Active 
- 3.4 Support staff to ensure that they are DRO Ongoing 
- DRO has established a series of briefings on 
using the right systems for the right purpose and in the right way through policies, guidance and training. 
current suite of guidance on records and information management with the Knowledge Champions Network, looking to address where it is felt there are gaps for 
users. (The Records Management Policy will also be updated). 


- 3.5 Consider methods to discourage the March 2018 Active 
- The DRO will liaise with OGDs to understand 
use of hard drives such as size limits or auto deletion after a certain period of time. 
their approach to this area and make a recommendation to KIMIT. 
- DCMS is a key stakeholder on the Better 
Information for Better Government (BI4BG) programme being led by Cabinet Office staff at steering and programme board level. 
 
Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
 
- 3.6 Factor in information and records March 2018 Active 
- The DCMS DRO and IT Lead will arrange to DCMS IT Lead and DCMS DRO 
management requirements as part of the IT procurement process as standard and ensuring that the Departmental Records Officer has a 'line in' to this. 
have a monthly catch up and ensure that where system changes take place there is a joined up approach (this has already been 
 
evidenced with the roll out of the new correspondence management system). 
- DCMS is a key stakeholder on the Better 
Information for Better Government (BI4BG) 
programme being led by Cabinet Office staff at steering and programme board level. 
 
- 3.7 Gain an oversight of systems and Ongoing Active 
- The further development of the IAR should DRO and DCMS IT Lead 
applications that are in use and identifying key information and records management risks. 
ensure that standalone Departmental systems are captured on the IAR and information risks understood and controlled by IAOs. 
 
- 3.8 Develop a plan to reduce the legacy 
 
March 2018 
 
Active 
- The DRO and IT lead are working together 
 
DRO and DCMS IT Lead 
digital information from Livelink including establishing what is held, identifying information of business and historical value. 
with TNA to map out DCMS's digital records holdings both to understand the Department's Public Records obligations in this area and also to establish a solution for the remaining data held in Livelink. 
- DCMS is a key stakeholder on the Better 
Information for Better Government (BI4BG) programme being led by Cabinet Office staff at steering and programme board level. 
 
- 3.9 Clarify whether information from March 2018 Active 
- DCMS is a key stakeholder on the Better 
legacy shared drives was migrated to Google. DRO and DCMS IT Lead 
Information for Better Government (BI4BG) programme being led by Cabinet Office staff at steering and programme board level. 

## Dcms Should Continue To Develop And Support Its Kim Team Governance And Team Structures And The Service That It Provides To The Business. 4

Initial DRO commentary post IMA on the starting point with each action area. Commentary last updated: December 2017 
 
Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
 
- 4.1 Provide senior management support 
 
Active 
- The DRO will undertake a benchmarking 
 
KIMIT DRO 
 
December 2017 
study to compare records and information management resourcing in DCMS with OGDs.  
 
- The DRO will include in this paper a 
to the DRO, ensuring that he and his team are equipped to discharge functions around information and records management and information assurance, in particular any legislative obligations (for example, Public Records Act, Data Protection). 
 
recommendation on the resource allocation required to ensure that the core Department can deliver against its legislative information obligations and business needs in terms of information management. 
 
- 4.2 Define the level of service that will DRO Active 
- The extent to which certain areas of work December 2017 
are taken forward will be dependent on the resource allocation discussed above. 
be provided from the central KIM team and how key aspects such as outreach, monitoring and driving improvement will be delivered. 
 
- 4.3 Ensure that all Knowledge 
Champions are clear on what their February 2018 Active 
 
 
- To draft a job description for the Knowledge 
responsibilities are and that the importance of these duties is recognised by their line managers. 
SCS Knowledge Champion 
Champions and to circulate to Deputy Directors across the Department. 
- The KIM Strategy is due in draft in time for 
the next KIMIT committee in Feb 18 
 
- 4.4 Consider how best to monitor March 2018 Active 
- To liaise with KIM Leaders across DRO 
government to understand how business unit level compliance is monitored across their organisations. 
compliance and raise capability with information and records management out in the business in a way that is proportionate for a relatively small department like DCMS. 

## 5 Dcms Needs To Continue To Maintain Its Progress In Appraisal And Selecting And Transferring Paper Records In Accordance With The Public Records Act And 20 Year Rule.

Initial DRO commentary post IMA on the starting point with each action area. Commentary last updated: December 2017 

 
Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
- 5.1 Continue to allocate appropriate 
- Resource continues to be allocated to the 
DRO 
Ongoing 
Active 
resource for the appraisal, selection, 
sensitivity review, disposal and transfer of paper records. 
outsourced records management service 
provided by DCLG with the first batch of records transferred to TNA and record destructions completed. DCMS will provide an update to ACNRA on 17 July. 
- DCLG now has 2 full time staff working for 
DCMS conducting micro and macro appraisal and transfer to TNA. 
- The department is confident to be fully 
compliant with the 20 Year rule by Dec 18. 
 
- 5.2 Consider how the process of 
- The DRO meets with DCLG every three Ongoing Active DRO 
sensitivity review (including use of FOI exemptions, redaction and closure applications) may need to change as DCLG and DCMS move to review more recent records which are likely to contain more sensitive information.  
weeks to discuss progress with record review and the end to end transfer and selection process. Quality checks are conducted on DCLG sensitivity review work. The quality assurance regime is set out in a Departmental policy on physical record transfer which has been signed off by KIMIT. 
 

## 6 Dcms Needs To Develop A Process For The Appraisal, Selection, Transfer And Sensitivity Review Of Its Digital Information.

Initial DRO commentary post IMA on the starting point with each action area. 

Commentary last updated: December 2017 

 
Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
 
- 6.1 Survey the digital information that March 2018 Active 
- The DRO and IT lead are working together DRO and DCMS IT Lead 
DCMS holds across all its systems (including age, format and subject matter) in order to build up a complete picture of its digital 
holdings. Use this to identify records that are at risk or due for digital review and transfer.   
with TNA to map out DCMS's digital records holdings both to understand the 
Department's Public Records obligations in this area and also to establish a solution for the remaining data held in Livelink. Recommendation to KIMIT on Livelink by March 2018. 
- DCMS is a key stakeholder on the Better 
Information for Better Government (BI4BG) programme being led by Cabinet Office staff at steering and programme board level, as are TNA. 
 
- 6.2 Explore and trial methods of digital Ongoing. Active 
- The DRO will liaise with MoJ to understand DRO and DCMS IT Lead 
the approach that they have taken to the appraisal of Digital Records. 
 
appraisal and selection (including the use of analytical tools), drawing on advice and guidance from The National Archives  and learning from the experience of other government departments in this area.  
- The DRO is working closely with his 
counterpart in Cabinet Office to understand the approach taken by an OGD using the G- suite and is now engaged in the BI4BG 
 
programme, which will directly address this challenge. 
 
Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
 
- 6.3 Ensure that knowledge of DCMS DRO Ongoing Active 
- The finalisation of the Operational Selection 
functions and records gathered through the existing paper review process are used to inform digital appraisal where possible.   
Policy (OSP) will go some way to ensuring that there is documented evidence of the key pieces of work and events since the formation of the Department in 1992. 
 
- The workshops that will be undertaken 
between TNA and DCMS to map the Department's digital record holdings over time will assist with further developing a corporate understanding of its digital record landscape. 
 
- DCMS is a key stakeholder on the Better 
Information for Better Government (BI4BG) programme being led by Cabinet Office staff at steering and programme board level. 
 
- 6.4 Engage with cross government work DRO Ongoing Active 
- The DRO is engaged with the Cross 
around the sensitivity review of digital information (including the use of analytical tools) and considering how these methods can be applied to digital records held at DCMS. 
Government: Records Management Project, Google Group, KIM Leaders and has completed the Digital continuity and Digital Transfer training. 
- 6.5 Work with Cabinet Office and The 
- It was agreed with TNA in June 2017 that 
National Archives on the transfer of DRO 
December 2017 Active 
DCMS would in the first instance produce a Digital Continuity plan for the ODA records 

 

significant digital records such as those of the Olympic Delivery Authority. 
before developing an approach to their transfer to TNA at the appropriate time. 

- DCMS is a key stakeholder on the Better 

Information for Better Government (BI4BG) 
programme being led by Cabinet Office staff at steering and programme board level.