| Status                                                        | Serial                                | Summary Recommendation                                     | Progress                         |
|---------------------------------------------------------------|---------------------------------------|------------------------------------------------------------|----------------------------------|
| No's                                                          |                                       |                                                            |                                  |
| 1,2,3,4,5,6,7,9                                               | Ongoing                               |                                                            |                                  |
|                                                               |                                       |                                                            |                                  |
| The Holding to Account process has been run for the first     |                                       |                                                            |                                  |
| time, with TLBs required to report to CIO how well they are   |                                       |                                                            |                                  |
| managing their information.                                   |                                       |                                                            |                                  |
| 1                                                             | Governance and leadership. MOD to     |                                                            |                                  |
| ensure that sufficient management                             |                                       |                                                            |                                  |
| controls for information are in place to                      |                                       |                                                            |                                  |
| support the achievement of its                                |                                       |                                                            |                                  |
| information strategy.                                         |                                       |                                                            |                                  |
|                                                               |                                       |                                                            |                                  |
| 10,11,12,13                                                   | Ongoing                               | What to Keep policy and guidance has been developed and    |                                  |
| made available to the Department. JSP 441 and other           |                                       |                                                            |                                  |
| information management documentation produced for             |                                       |                                                            |                                  |
| operations is being refreshed.                                |                                       |                                                            |                                  |
| 2                                                             | Records and information management.   |                                                            |                                  |
| MOD to review and improve guidance                            |                                       |                                                            |                                  |
| and rules for creation and storage of                         |                                       |                                                            |                                  |
| information and records.                                      |                                       |                                                            |                                  |
|                                                               |                                       |                                                            |                                  |
| 14                                                            | Ongoing                               | There will be no NTFS training courses.  Work has begun to |                                  |
| deliver training for staff in data protection roles.          |                                       |                                                            |                                  |
| 3                                                             | Training. MOD to confirm provision of |                                                            |                                  |
| sufficient, consistent and effective                          |                                       |                                                            |                                  |
| training for IM professionals.                                |                                       |                                                            |                                  |
|                                                               |                                       |                                                            |                                  |
| 8, 15,16                                                      | Ongoing                               | 4                                                          | Risk Management.  MOD tackle the |
| varied understanding of information                           |                                       |                                                            |                                  |
| risk, ensure key information risks are                        |                                       |                                                            |                                  |
| clearly addressed and information                             |                                       |                                                            |                                  |
| losses are reported on fully.                                 |                                       |                                                            |                                  |
|                                                               |                                       |                                                            |                                  |
| Records risks are reviewed every six months by CIO, and       |                                       |                                                            |                                  |
| these and other information risks are captured within Defence |                                       |                                                            |                                  |
| Board strategic risks which are also reviewed annually by the |                                       |                                                            |                                  |
| Defence Audit Committee.  Information risk appetite is        |                                       |                                                            |                                  |
| articulated and a risk-balance process exists to deal with    |                                       |                                                            |                                  |
| proposals falling outside this appetite.  Further digital     |                                       |                                                            |                                  |
| continuity work is in hand.                                   |                                       |                                                            |                                  |
| 17                                                            | Ongoing                               | Some initial work conducted to improve knowledge           |                                  |
| management.                                                   |                                       |                                                            |                                  |
| Common information induction achieved through the IM          |                                       |                                                            |                                  |
| passport.                                                     |                                       |                                                            |                                  |
| 5                                                             | Culture.  MOD to ensure commonality   |                                                            |                                  |
| in induction and knowledge                                    |                                       |                                                            |                                  |
| management processes across the                               |                                       |                                                            |                                  |
| Department.                                                   |                                       |                                                            |                                  |
|                                                               |                                       |                                                            |                                  |
|                                                               |                                       |                                                            |                                  |