## Cabinet Office Ima Action Plan

| Theme                                              | TNA Assessment                                | What Cabinet Office will do          |
|----------------------------------------------------|-----------------------------------------------|--------------------------------------|
| areas covered                                      |                                               |                                      |
| -                                                  | Continued improvement in all                  |                                      |
| performance areas of Information                   |                                               |                                      |
| Management reducing risk of information            |                                               |                                      |
| loss, data breaches and reputational               |                                               |                                      |
| damage                                             |                                               |                                      |
| During 2019-2020, we will review and update the    |                                               |                                      |
| Cabinet Office Information Management Strategy,    |                                               |                                      |
| approved by its Executive Committee in 2017,       |                                               |                                      |
| with a view to developing proposals, among         |                                               |                                      |
| others, to:                                        |                                               |                                      |
|                                                    |                                               |                                      |
| Information                                        |                                               |                                      |
| Management                                         |                                               |                                      |
| Strategy                                           |                                               |                                      |
|                                                    |                                               |                                      |
|                                                    |                                               |                                      |
|                                                    |                                               |                                      |
|                                                    |                                               |                                      |
|                                                    |                                               |                                      |
| -                                                  | Identify digital continuity risks and develop |                                      |
| plans to mitigate these                            |                                               |                                      |
| -                                                  | Help staff and leaders know what their        |                                      |
| responsibilities are to secure public              |                                               |                                      |
| records for accountability and historic            |                                               |                                      |
| needs                                              | -                                             | Further drive compliance with senior |
| support                                            |                                               |                                      |
| -                                                  | Updating staff guidance and training          |                                      |
|                                                    |                                               |                                      |
|                                                    |                                               |                                      |
| -                                                  | Reduce inefficiency and risk caused by        |                                      |
| over retention, duplication and not being          |                                               |                                      |
| able to find information in a timely               |                                               |                                      |
| manner                                             |                                               |                                      |
| 1.1 Improving                                      |                                               |                                      |
| Information                                        |                                               |                                      |
| Management                                         |                                               |                                      |
| Capability                                         |                                               |                                      |
|                                                    |                                               |                                      |
| 1.2 Controlling                                    |                                               |                                      |
| Legacy Information                                 |                                               |                                      |
|                                                    |                                               |                                      |
| 2.1 IT Systems &                                   |                                               |                                      |
| Tools                                              |                                               |                                      |
|                                                    |                                               |                                      |
| 2.2 Technical                                      |                                               |                                      |
| Change                                             |                                               |                                      |
|                                                    |                                               |                                      |
| 3.2 Promoting Policy                               |                                               |                                      |
| & Guidance                                         |                                               |                                      |
| -                                                  | Continue to meet transition to 20 year        |                                      |
| rule                                               |                                               |                                      |
| -                                                  | Maintain levels of compliance with the        |                                      |
| Public Records Act                                 |                                               |                                      |
| Review & Transfer                                  |                                               |                                      |
| of legacy                                          |                                               |                                      |
| collections                                        |                                               |                                      |
|                                                    |                                               |                                      |
|                                                    |                                               |                                      |
|                                                    |                                               |                                      |
| -                                                  | Secure digital records, where needed          |                                      |
| 4.1. Transfer to The                               |                                               |                                      |
| National Archives                                  |                                               |                                      |
|                                                    |                                               |                                      |
| 4.2 Appraisal,                                     |                                               |                                      |
| Selection and                                      |                                               |                                      |
| Sensitivity Review                                 |                                               |                                      |
| Process                                            |                                               |                                      |
|                                                    |                                               |                                      |
| -                                                  | Develop a roadmap to deliver digital          |                                      |
| record selection, review, redaction and            |                                               |                                      |
| transfer                                           |                                               |                                      |
| -                                                  | Continue to work to manage increasing         |                                      |
| We are resourcing the transition from the 30 to 20 |                                               |                                      |
| year rule with a view to this being completed by   |                                               |                                      |
| 2023.                                              |                                               |                                      |
|                                                    |                                               |                                      |
| We have established a project to design and        |                                               |                                      |
| build the department's digital corporate memory    |                                               |                                      |
| and digital archiving processes. We aim to create  |                                               |                                      |
| this new capability by 2023/24.                    |                                               |                                      |
|                                                    |                                               |                                      |
| We will seek to design the appraisal, selection    |                                               |                                      |
| volumes of records                                 | and review processes required for digital    |
|----------------------------------------------------|----------------------------------------------|
| information, prior to its transfer to The National |                                              |
| Archives.                                          |                                              |
|                                                    |                                              |
| -                                                  | Continuing positive change in Cabinet        |
| Office to create a sustainable IM culture          |                                              |
| Governance and                                     |                                              |
| Leadership                                         |                                              |
|                                                    |                                              |
|                                                    |                                              |
| -                                                  | To identify historic public records and      |
| secure them for the future                         |                                              |
| -                                                  | Improved compliance and stronger             |
| controls to manage risk and tackle                 |                                              |
| issues early                                       |                                              |
|                                                    |                                              |
| The Department's Information Management            |                                              |
| Board will continue to oversee delivery of the     |                                              |
| departmental strategy, alongside the               |                                              |
| department's other governance arrangements to      |                                              |
| continue driving compliance, and manage risk.      |                                              |
|                                                    |                                              |
| We will continue to explore how to embed           |                                              |
| stronger accountability for good information       |                                              |
| management among the SCS.                          |                                              |
| 1.3 Identifying                                    |                                              |
| Information                                        |                                              |
| Management Risks                                   |                                              |
|                                                    |                                              |
| 3.1 Defining Roles                                 |                                              |
| and establishing                                   |                                              |
| governance                                         |                                              |
| structures                                         |                                              |
|                                                    |                                              |
| 3.3. Monitoring                                    |                                              |
| Current Practice                                   |                                              |
|                                                    |                                              |