## Priority Recommendations R1 The Department For Education (Dfe) Should Continue To Develop And Improve Its Approach To The Management Of Its Current And Legacy Digital

information. This would be supported by: · IT Group and Information Services reviewing the IM and IT strategies to ensure a joined-up approach to the management of data and records. · Developing a plan for the ongoing continuity of digital information (both current and legacy). This would build on the work to identify critical systems, data and their value. · Ensuring that IM requirements are considered when systems and platforms are implemented and upgraded. · Making it mandatory to save official records in Workplace. · Placing greater restrictions on the use of email inboxes and PST (Personal Storage Table) files (including size limits) to encourage staff to save information into Workplace (linking to awareness and training for Workplace and Colligo - see Recommendation 4  
· The Information Services team, collaborating with the Senior Information Risk Officer (SIRO), the Departmental Security Unit (DSU), and Policy leads, developing clear policy and guidance on what information can be published and made accessible through Workplace, and which areas need secure collaborative sites to enhance secure information-sharing and decision-making processes. · Content Managers and Policy leads identifying other work areas with which they need to collaborate and share sensitive information (as part of decision-making or policy development); and liaising with the Information Services team on requirements for establishing shared/controlled Workplace sites. · Information Services developing a customised template (based on the intranet classification scheme) to assist Workplace users and Content Managers in establishing a controlled file structure.    

R1 Actions 
Priority: 
Action 1.1 Meet with key stakeholders within IT Group, to determine dependencies for both IM and IT strategies. 
High 
Feb-17 
Open 
Action 1.2 Undertake a digital systems audit which will determine scope and enable development of a plan which will ensure ongoing continuity of digital information 
Medium 
May-17 
Open 
Action 1.3 Process in place which will ensure that IM are notified if a new system is being implemented which will 
impact on Information Management 
High 
Jun-16 
Due for 
High/Low/Medium 
completion Status 
|                                                                                           |                                                                                                            | Action 1.4   |  Programme of KIRM culture change to be developed, focusing on ensuring Workplaces is the    |
|-------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------|--------------|----------------------------------------------------------------------------------------------|
| mandatory records repository.                                                             | High                                                                                                       | Apr-17       | Open                                                                                         |
| Action 1.4                                                                                | Auto-retention of records within Workplaces implemented                                                    | High         | Apr-17                                                                                       |
| Action 1.5                                                                                | Gain approval to reduce the size of e-mail inboxes and restrict PST folders to 'read only'.  (linking into |              |                                                                                              |
| KIRM culture change programme - 1.4)                                                      |                                                                                                            | High         | Jun-17                                                                                       |
| Action 1.6                                                                                | Guidance produced which provides clear vision of permissions and access rights for content held on         |              |                                                                                              |
| Workplaces                                                                                |                                                                                                            | High         | Jun-17                                                                                       |
| Action 1.7                                                                                | Process to be agreed which will allow workplaces to be open by default (where appropriate)  IM team        |              |                                                                                              |
| also to review work area links across Workplaces to enable links between Content Managers |                                                                                                            | High         | Jun-17                                                                                       |

The Information Services team and Information Assurance staff should work together to improve oversight and control of DfE's information assets.  
This would be supported by: · Continuing the current review of the governance and reporting models, planning to ensure that the reporting of information assets by the Information Asset Owners (IAOs) is monitored on a monthly basis. · Reviewing the current definition of information assets, and identifying what key fields need to be mandatory in the Information Asset Register, to ensure that DfE is satisfactorily meeting its statutory and reporting requirements. · Examining the option of adopting a proportionate approach to ownership of information assets, particularly for those that have been identified as having critical or high-level importance to DfE.    

R2 Actions 
Priority: 
Action 2.1 Establish a centralised electronic Information Asset Register (IAR) (viewable to everyone in the department) which IAOs are encouraged to review and update throughout the year.   
Medium 
Apr-16 
Closed 
Action 2.2 Mandatory fields within IAO register to be established 
Medium 
Apr-16 
Closed 
Action 2.3 'Critical assets' to be identified as part of Annual IAO return, SIRO to be informed and made aware of critical assets 
Medium 
May-16 
Closed 
 
 
Due for 
High/Low/Medium 
completion 
Status 

DfE should ensure that the new information management strategy sets goals for the whole department and is linked to improvements in technology, governance and culture. This would be supported by:  
· Establishing a Knowledge and Information Management Governance Board to formalise current relationships and ensure clearly documented reporting mechanisms. · Ensuring that IM requirements are considered when implementing or upgrading new systems and procedures, and when migrating data and records to new platforms. · Ensuring that accreditation and assurance of systems is at an appropriate reporting level, as agreed by the Management Committee. · The Information Services team collaborating with Workplace Content Managers to establish measurable assurance and reporting for the capture and management of records in Workplace, to provide ongoing benefit.    

R3 Actions 
Priority: 
Action 3.1 KIM Governance Board to be established 
Medium 
Dec-17 
Open 
Action 3.2 Process in place which will ensure that IM are notified if a new system is being implemented which will impact on Information Management.  (Also links to **Action 1.1)** 
High 
Jun-16 
Open 
Action 3.3 Accreditation and Assurance of systems to be reviewed with Departmental Security Unit 
Medium 
Jul-17 
Open 
Action 3.4 Agreeing requirements regarding what information needs to be tracked  
High 
Aug-16 
Closed 
  
Action 3.5  Analytical tool to be implemented, which will allow measurable assurances around capture and management of records and information 
Medium 
Mar-17 
Due for 
High/Low/Medium 
completion 
Status 

DfE should build on the current guidance and awareness of staff through a coordinated training and education programme This would be supported by: · Knowledge and Information Management (KIM) stakeholders collaborating with the Internal Communication team on a communication plan to 
promote the importance of proper Information Management (IM). · Clearly defining the responsibilities of the Information Services team (and all departmental staff) in terms of IM. · Ensuring that the IM responsibilities of the Information Services team (and all department staff) are promoted and supported by senior managers through agreed governance committees and through targeted and regular messages. · Including a session on the importance of KIM as part of the mandatory induction for new staff and refresher training for current staff. · Building on current work with Content Managers (CMs) by encouraging greater collaboration within the CM Community, placing greater emphasis on performance reporting (Workplace), and enlisting key CMs as lead champions within their directorates to monitor and report on performance. · Developing and promoting a defined IAO community that focuses on providing a portal for joined-up collaboration, communication, and assistance. This should be linked to ongoing risk awareness (of strategic and information risk) and ongoing training and awareness-raising for IAOs. · Ensuring that the new induction pack includes mandatory Workplace/IM training for end users, and additional training for CMs and IAOs.  
· Ensuring that training and awareness includes clear guidance to staff on what information needs to be captured in Workplace (and what can be published to the intranet), and on how, why and when to 'check in' and 'declare' records. · Refreshing and promoting guidance through newsletters and desk aids to assist understanding of key tasks when implementing Workplace and Colligo Engage, and when capturing information into Workplace. · Investigating technical solutions that may reduce the burden of capturing the right information into Workplace.   

R4 Actions 
Priority: High/Low/Medium 
Action 4.1 Dedicated communications plan for KIRM to be implemented 
High 
Jul-16 
Closed 
Action 4.2 Roles and responsibilities for both IS team and DfE staff, (developed as part of I'm strategy) to be communicated  
Medium 
Apr-17 
Open 
Action 4.3 See Action 3.1 
  
May-17 
  
Action 4.4 KIRM section to be implemented into new starters induction programme 
Medium 
Aug-17 
Open 
  
Action 4.5 Develop a network of 'Content Manager Champions' who are able to monitor performance of 
workplaces 
Medium 
Aug-16 
Due for 
completion Status 
  
Action 4.6 Further development of an 'IAO community' driven by Content Manager Champions 
Medium 
Apr-17 
Open 
  
Action 4.7 Implement mandatory Workplaces and IM training for new starters 
Medium 
Aug-17 
Open 
  
Action 4.8 Training plan to be developed, outlining training and guidance material to be provided to staff 
Medium 
May-17 
Open 
  
Action 4.9 Review of IM and RM guidance, to include further consideration to desk aid support for Workplaces 
Medium 
May-17 
Open 
 

DfE should continue to develop its approach to managing information risk. This would be supported by: · Promoting departmental and government risk management policy on an ongoing basis. · Improving awareness of the assurance that the SIRO provides to DfE and the importance of the role. · Ensuring that any information risk with potential departmental impact (or higher) is reported to the Permanent Secretary and the DfE Board as standard procedure. · Reviewing the role of the SIRO and their relationship with the DfE Board; establishing the SIRO as a defined DfE Board member.  
· Including updates and reporting on information risk by the SIRO as a standing agenda item for Management Committee meetings. · Including the examination of the maintenance of critical and high-value systems as part of the annual assurance activities carried out by the Internal Audit team. · Improving awareness of the Information Risk policy and the importance of tracking, reporting and escalating strategic and information risks to relevant governance committees. This includes the tracking of information risks in relevant lines of business risk registers. · Coordinating the reporting and oversight of information risk through key stakeholder teams (DSU, Information Services, Knowledge Management Groups) and key users (KIM Champion, Content Managers, IAOs).    
R5 Actions 
Priority: 
Action 5.1 Risk register to be finalised for both IM and RM 
High 
Jan-17 
Open 
Action 5.2 Risk register to be reviewed at KIRM Governance Board meetings 
Medium 
Jan-17 
Due for 
High/Low/Medium 
completion Status 

## R6 Dfe Should Improve Its Awareness And Oversight Of Information Holdings And Ensure That All Holdings Are Identified As To Current Use And Future

disposal. This would be supported by:  
· Promoting the Departmental Records Officer (DRO) role and responsibilities at a senior level to ensure understanding of their remit at DfE Board level. · The DRO providing regular reports to the Management Committee on how DfE is meeting statutory requirements and is improving the management of its data and records. · Reviewing retention and disposal schedules with key stakeholders to ensure that these schedules meet both business needs and statutory requirements. · Rationalising the digital estate to ensure good information management. As part of this, obtaining guidance and liaising with key stakeholders (including Government Digital Service and The National Archives). · The DRO liaising with DfE's third-party storage contractor and developing a review plan to apply required context and retention to any holding that does not meet required standards. · The DRO collaborating with Estates Management (and other key stakeholders) to identify paper holdings held in current work sites.  
· Building on current work to streamline the transfer process by producing a plan for managing the selection and transfer of paper and digital records to The National Archives.    

R6 Actions 
Priority: 
Action 6.1 Promotion of DRO role achieved through Governance reporting up to board level 
Medium 
Jan-17 
Open 
Action 6.2 Reports to Management Committee to be generated following on from KIM Governance Board meetings 
Medium 
Jan-17 
Open 
Action 6.3 Review of retention and disposal retentions to be undertaken as part of auto-retention implementation 
Medium 
Apr-17 
Open 
Action 6.4 Rationalisation of digital estate to be completed 
Medium 
Aug-17 
Open 
Action 6.6 Review and corrective action on paper records with missing/incorrect metadata to be completed 
Medium 
Aug-17 
Open 
  
Action 6.7 Selection and transfer plan to be completed (with agreement from IMC) 
Medium 
Apr-17 
 
Due for 
High/Low/Medium 
completion Status