## 1 Defra To Bring Information And Records Management Practice Within Scope Of Kim Vision Statements And Establish A Plan To Develop And Maintain The Right Information Management Culture. Active And Visible Support Of Senior Management Is Needed To Promote Change.

Commentary on progress against main recommendation heading: KIM has opportunites to raise the profile, awareness and need for better records and information management, by a) becoming better embedded in DDTS, b) key contributor to the change management programme for O365, c) ensuring KIM principles are part of the O365 design and architecture, d) ensuring the training for O365 reflects how we can help the business to manage its information more efficiently e) briefing the O365 Senior Champion.    

Commentary last updated: July 2018 
Enabling/supporting actions recommended by TNA 
Owner 
Commentary on progress 
Completion due 
Status 
Head of KIM The Chief Operating Officer and Director 
On going  
Ongoing 
Formally appointing a senior champion for information and records management to sponsor key communications and campaigns 
and provide visible leadership, including leading by example. 
General for Defra Operations now has the role of senior champion.  She has already taken the 
lead in personally launching the smarter ways of working programme, that includes KIM, creating 
a platform to enable a culture that's open and 
collaborative, where people work together. 
Head of KIM Initially, will involve working with key O365 
Ongoing 
Prior to rollout of O365 
Ensuring KIM vision statements are built into DDTS planning and formally aligned to Defra Group strategic objectives. The relationship between KIM visions and the Office 365 adoption strategy vision should be clarified. 
partners, ensuring KIM messages are embedded in system design, strategy & comms. The second strand will be to ensure the KIM vision to form part of the wider DDTS strategy 
July 
 
DRO 
To liaise with owner of assurance statements & ensure records management is more clearly embedded 
Factoring information and records management into Director's assurance statements as done by departments in the IMA programme including the Foreign and Commonwealth Office. 
July 
 
DDTS Security Manager 
IT Security are responsible - to discuss key IM messages that will make a difference 
Updating the annual personal commitment statement to provide more effective coverage for information management. 
 

## 2 Defra To Deliver Greater Support And Challenge To Iaos, Ensuring Key Threats Are Surfaced Consistently. This Report Places Particular Emphasis On Those Related To Lifecycle Management And Digital Continuity.

Commentary on progress against main recommendation heading: The Information Asset Owner network is owned by and managed by IT 
Security; KIM can work in partnership with IT Security to review messaging, training and a more structured approach to recording and managing information risks. 

Commentary last updated: July 2018 
Enabling/supporting actions recommended by TNA 
Owner 
Commentary on progress 
Completion due 
Status 
KIM to liaise with IT Security 
August 
 
DDTS Security Manager 
Ensuring a central steer is provided to new IAOs on the requirements of the role and establishing Defra specific guidance. This 
should include adapting the IAO Handbook, following the example of IMA programme members such as the Ministry of Justice. 
IT Security to liaise with Information Appraisal  
July 
 
Engaging with the KIM team to identify what lifecycle and digital continuity related factors should be captured on the Information Asset Register. 
DDTS Security Manager/ Head of Information Appraisal 
To be agreed 
 
IT Security to carry out out benchmarking exercise with DoT & DoE.  
DDTS Security Manager 
Drawing on models used by other IMA programme members such as the Department for Transport and Department for Education to enable a more structured approach to IAO reporting and risk assessment. 

## 3 Defra To Identify Digital Continuity Priorities To Ensure The Usability Of Digital Information And Embed These In Kim Planning.

Commentary on progress against main recommendation heading: Defra has used TNA's DROID tool to analyse information held on file shares and information/formats at particular risk.  This approach has not been extended to datasets where additional analysis may be necessary.  O365 
will present new challenges; information formats will be continually updated, but in turn this may result in the loss of formatting and authenticity. 

Commentary last updated: July 2018 
Enabling/supporting actions recommended by TNA 
Owner 
Commentary on progress 
Completion due 
Status 
In progress 
September 2018 
Factoring consideration of information and records management and digital continuity into IT procurement. 
 
DRO 
DRO to liaise with DDTS Engagement Team & ensure that continuity of information is included in new business systems. DRO has also engaged with the Defra Data 
team and discussions are in progress regarding management and retention. 
Head of KIM Perm Sec recognised the value of the self 
assessment tool. Next step is to check self assessment questionnaire covers the Defra group needs and circulate to Agency/NDPB Chief Executives for completion.  
August 2018 
Perm Sec has agreed in March Self Assessment process would add value. 
Promoting use of the IMA programme's Self- Assessment Questionnaire to members of the Defra Group as a means of benchmarking capability. Doing this now will help assess preparedness for migration to Office 365 and identify any digital legacy related risks. 

## 4 Defra To Define The Risk To The Department And Wider Defra Group Of A Failure To Manage Information And Records Effectively And A Failure To Ensure Digital Information Remains Usable. Mitigating Actions And Monitoring Mechanisms Should Be Established.

Commentary on progress against main recommendation heading: Information risk is owned by IT Security. It has produced a pan-Defra risk policy but awareness appears to need improvement.  KIM can reviewed the risk policy ensuring information risks are better understood and presented in a language more compelling for the end user.  Arrangements for reviewing risks will need to reflect whether or not the SIRO role remains. 

Commentary last updated: July 2018 
Enabling/supporting actions recommended by TNA 
Owner 
Commentary on progress 
Completion due 
Status 
To be agreed 
 
DDTS Security Manager 
IT Security to update the Information Risk Policy (2016).  To ensure it reflects Defra Group plans for information records management.  
Producing a departmental information risk policy that covers information and records management related risk. 
 
 
Head of KIM  KIM will capture the IM related risks it faces and 
To be agreed 
 
Embedding definitions at a proportionate level within the DDTS risk reporting framework, including mitigating actions. 
get a consolidated and agreed risk described and logged on risk registers, particularly given the amount of change Defra is going through and the amount of EU Exit related work it is involved in.  
Defra's Strategic Risk Guidance and recognising 
the potential reputational, operational and legal impacts, DDTS is the level at which mitigation is being applied and therefore the right level for ownership and from which the risk may be escalated. 
Head of KIM  To liaise with Change Management Team for 
TBC 
 
Encouraging business areas to define the risks that poor information management practice raise. 
O365 & include messaging on promoting best practice for information management in training given to business teams. 

## 5 Defra To Maintain The Priority Currently Attached By Office 365 Plans To Information Management And Information Assurance, Ensuring Opportunities To Strengthen Governance And Embed Good Practice Are Taken.

Commentary on progress against main recommendation heading: Defra has already taken the lead in working with network partners to agree common information policies that will operate in O365.  These include improved management of email, a drive to encourage saving evidential information in Sharepoint as a corporate asset, improved collaboration.   

Commentary last updated: July 2018 
Enabling/supporting actions recommended by TNA 
Owner 
Commentary on progress 
Completion due 
Status 
On-going 
Completed in Jan 2018 
KIM Steering Group 
Reviewing Defra's policy on restricting 
personal storage and ensuring proportionate enforceable controls are in place now and for 
potential risk areas such as OneDrive. 
A series of KIM policies for O365 has already been agreed by Corporate Services Board (CSB) & will be reviewed annually.  Additional 
changes KIM might want to introduce will also be cleared with CSB.  
O365 Adoption Lead 
In progress 
The Email migration component is due to be completed this calendar year.  
To form part of the training delivered to business teams using O365. Further progress on hold until BAU activity can commence. A policy decision has been taken to discontinue using Vault and IT are considering how best to migrate out legacy Vaulted emails 
Providing targeted support to staff in addition to this to help drive the right behaviours in key areas such as email management, Vault usage and records capture. Welsh 
Government's project to tackle archived 
emails and improve email management may be helpful. 
Ongoing 
 
O365 Adoption Lead 
Ensuring ongoing focus on actions taken by LICs and staff to support effective application and implementation of retention schedules. 
SharePoint Business Partners (SPBP's) proactively support the LIC network on roll-out & follow up reviews.  Retention standards have 
been agreed and are applied by SPBP's to 
ensure correct application. 
Ongoing 
 
Lessons learned from SP13 roll-out are being applied to O365 
O365 Adoption Lead 
Reusing work already conducted for the SharePoint 2013 roll-out and learning lessons. 
Head of KIM Already actioned. 
 
Including KIM membership on DDTS governance boards. 
KIM to work with Change Management Team to 
discuss support arrangements for O365 post rollout. 
Head of 
KIM/ Business Change Lead 
Identifying how the implementation and 
embedding work and delivery of a KIM service will be resourced and supported. This needs to include use of devolved networks, with consideration given to the provision of administrative support as well as active championing of good practice in overall terms. 
| Completed    |     |
|--------------|-----|
| In Progress  |     |

## 6 Defra Continue Promoting Information And Records Management Policy And Supporting Guidance. This Should Be Reviewed Before The Introduction Of Office 365 To Ensure An Effective Mandate Is Established For Teams And Individuals.

Commentary on progress against main recommendation heading: The KIM Defra Group are committed to producing and agreeing common policies and guidance to embed information and records management in our new ways of working with Office 365 

Commentary last updated: July 2018 
Enabling/supporting actions recommended by TNA 
Owner 
Commentary on progress 
Completion due 
Status 
To be discussed with HR 
 September 
 
DRO/ KIM O365 Coordinator 
Engagement between HR and KIM to establish a joined up process for coverage of information management during induction. 
To discuss with DDTS Data Sharing Team 
responsible for publishing on Gov.uk 
Head of 
Information Appraisal 
Publishing What to Keep or other retention 
guidance publicly, as recommended in Sir Alex Allan's 2014 Records Review report. 
 September 
What to Keep 
Guide currently being updated 
July 
 
DRO 
DRO to liaise with Secretariat/Private Offices 
Working with private offices to ensure original ministerial comments are being captured as part of the record. 
DRO 
To be considered in consultation with TNA. 
 
 
Following good practice principles established by the Section 46 Code of Practice such as Board level sign off. Policy should ideally establish the role of individuals, managers and senior staff in making sure information is managed effectively. 
 

## 7 Defra To Build On The Positive Start Made Through Team Site Reviews And Establish A New Performance Monitoring Model That Can Be Developed And Embedded Over The Long Term.

Commentary on progress against main recommendation heading: The team site review methodology is now well established, lessons learned and recognised as being helpful to inform directors.   It is anticipated that a similar "audit function" will be adopted in the future to ensure continual improvement, however immediately ahead, the rollout of Office 365 will fully occupy exisiting resources to deliver SharePoint sites and training. 

Commentary last updated: July 2018 
Enabling/supporting actions recommended by TNA 
Owner 
Commentary on progress 
Completion due 
Status 
 
 
O365 Adoption Lead 
Drawing on the good practice approach implemented by HM Treasury, which factors in senior accountability and use of statistics. 
 
Teamsite reviews completed & methodology established. Review resource likely to be diverted to O365 roll-out. Further progress on 
hold until BAU activity can commence. See above. 
 
 
Incorporating qualitative as well as quantitative measures. 
O365 Adoption Lead 
 

## 8 Defra To Maintain The Priority Currently Attached To Meeting The Requirements Of The 20-Year Rule Transition Period.

Commentary on progress against main recommendation heading: Defra has already produced a five year plan and it aware of peaks and troughs in the appraisal programme and the demands of particular record sets.  To assist the appraisal of digital information (due 2021) Defra will continue researching suitable data analytical tools with a view to procurement once existing electronic holdings have been migrated to the cloud. 

Commentary last updated: July 2018 
Enabling/supporting actions recommended by TNA 
Owner 
Commentary on progress 
Completion due 
Status 
Completed 
Ongoing  
Establishing an appraisal report. 
Head of Information Appraisal (paper) 
Items selected for TNA are entered on an annual spreadsheet (recently revised).  Defra will continue to develop a digital appraisal methodology and appraisal plan, the latter to 
reflect TNA's best practice model    
Completed 
Ongoing 
Regular planning meetings with IMC every 2 -3 months.  Workforce planning to ensure adequate resource to meet Statutory 20 year commitments 
Continuing to engage with The National Archives as it defines a deliverable five-yearplan, ensuring it has capacity to keep pace with the transition to the 20-year rule.  
DRO/Head of Information Appraisal 
Completed 
Ongoing 
Defining the risk to Defra's ability to comply 
with 20-year requirements if further legacies in all paper or digital format are inherited due to machinery of government changes. 
DRO/Head of Information Appraisal 
Regular planning meetings with IMC as above. The Records Management risk register to reflect potential challenges of dealing with further inherited records from the one Defra initiative. 
December 
 
DRO/ Record Manager 
Identifying how data and use of analytical 
models can be factored into Defra's 
information and records management approach 
  Discussions with the Data team will ensure that data and models used to inform policy are identified as in scope for potential selection and transfer. 
On going 
Including maintenance of function pages in team site reviews. 
Principle has been agreed 
O365 Adoption Lead 
In the creation of new teamsites for O365, KIM will ensure that function pages are maintained to provide a full history of the site and key records. This will be essential to assist e-Review and appraisal in the future.