## Priority Recommendations Bis To Elevate The Profile Of Information Risk In Support Of Kim Strategy Aims For The Protection, Management And Exploitation Of Information.

This would be supported by: 

 
Establishing policy on information risk. As with guidance for Information Asset Owners (IAOs) referenced below, this should be explicitly aligned with the KIM strategy goals. 
 
Ensuring information risks are documented corporately, such as risks resulting from a failure to manage information in accordance with its value, with clear escalation paths so that strategic impacts can be recognised. This work could draw on risks already defined within KIM policy 
and through the FIMS project together with those highlighted in the body of this report. 
 
Clearly establishing tolerances and appetites for information risk. 

| R1 Actions                                             | Priority:     |
|--------------------------------------------------------|---------------|
| High/Low                                               |               |
| / Medium                                               |               |
| Owner                                                  | Due for       |
| completion                                             |               |
|                                                        |               |
| High                                                   | tbc           |
| Action 1.1                                             |               |
| Develop an Information Risk Policy to sit              |               |
| alongside the Knowledge and Information Strategy and   |               |
| refreshed Information Asset Register (IAR)             |               |
| High                                                   | tbc           |
| Action 1.2                                             |               |
| On completion of the Information Asset                 |               |
| Register (IAR) develop a SIRO Risk Register that works |               |
| in line with Security Management Risk overview         |               |
| reporting.                                             |               |
| Action 1.3                                             |               |
| Issue a statement on information risk in BIS           |               |
| from the SIRO                                          |               |
| Medium                                                 | SIRO          |
| working with                                           |               |
| others (tbc)                                           |               |

## R2 Bis To Ensure Lessons Are Learned From The Adoption Of Matrix And Use Of Alternative Repositories And Ensure Requirements For The Use And Management Of Information Remain At The Heart Of The Fims Project. These Must Inform Decision Making On Configuration, Implementation And Contingency Planning.

Observations 
Status 

## Key Requirements In This Regard Include Discovery, Ease Of Use Together With Current Strengths Of The Edrms Such As Access Controls And Lifecycle

management. This would be supported by: 

 
Ensuring the risks of meeting and not meeting business requirements in practice are fully defined, and that the potentially significant impacts have visibility beyond the FIMS project. 
 
Close liaison with the business to identify key needs and help prioritise migration.  
 
Maintaining control and oversight of the technology environment as a whole following roll-out of new systems, particularly in terms of any necessary additional or alternative repositories. 
 
Mapping usage requirements of key information assets in line with The National Archives guidance. 

| R2 Actions                                              | Priority:     |
|---------------------------------------------------------|---------------|
| High/Low                                                |               |
| / Medium                                                |               |
| Owner                                                   | Due for       |
| completion                                              |               |
|                                                         |               |
| High                                                    | FIMS Project  |
| Team                                                    |               |
| Action 2.1                                              |               |
| Ensure that the new ECM is configured in a              |               |
| way that meets all agreed business and statutory        |               |
| requirements                                            |               |
| High                                                    | Business      |
| Transition                                              |               |
| Team                                                    |               |
| Action 2.2                                              |               |
| Develop a Data Migration strategy that                  |               |
| enables the business to identify and assess information |               |
| of value to transfer to the new ECM. Secure support for |               |
| approach and sign-off from the BIS Operations           |               |
| Committee.                                              |               |
| High                                                    | Ways of       |
| Working                                                 |               |
| (WoW)Team                                               |               |
| Action 2.3                                              |               |
| Using a variety of channels (intranet, email,           |               |
| staff briefings etc) (i) communicate data cleansing and |               |
| migration actions required of staff and (ii) monitor    |               |
| compliance by running reports on email inbox size and   |               |
| personal drive storage.                                 |               |
|                                                         |               |
| Medium                                                  | KIM Team /    |
| WoW Team                                                |               |
| Action 2.4                                              |               |
| Once the new ECM has been rolled out                    |               |
| monitor usage of ECM and alternative repositories as    |               |
| part of benefits work                                   |               |
| High                                                    | FIMS Project  |
| Team                                                    |               |
|                                                         |               |
| Action 2.5                                              |               |
| Ensure all business requirement risks                   |               |
| relating to the FIMS project are entered on the FIMS    |               |
| Observations                                            |               |
| Status                                                  |               |
|                                                         |               |
| December 2013                                           | Closed        |
| November 2013                                           | Closed        |
| January 2014                                            | Closed        |
| May 2014 -                                              |               |
|                                                         |               |
|                                                         |               |
| November 2013                                           | Closed        |

## Risk Register And Flite Benefits Register. Bis To Produce A Clear And Detailed Implementation Plan For Its Kim Strategy To Define How Threats Will Be Reduced, Opportunities Realised R3 And Outcomes Delivered. This Would Be Supported By:

 
Aligning the work and deliverables of the KIM team and that of other stakeholders to strategy outcomes  
 
 
Developing a plan to promote and drive the adoption of new policy and guidance for information management during and following system roll-
 
out. 
 
 
Directing policy and guidance towards cultural barriers to good practice and system usage such as perceived lack of time to capture 
 
information corporately. 
 
 
Identifying quantifiable performance indicators and success criteria, defining how these will be used to target risk areas and potential areas of good practice.   

| R3 Actions                                             | Priority:     |
|--------------------------------------------------------|---------------|
| High/Low                                               |               |
| / Medium                                               |               |
| Owner                                                  | Due for       |
| completion                                             |               |
|                                                        |               |
| High                                                   | Head of KIM   |
| Action 3.1                                             |               |
| Produce KIM Strategy implementation plan               |               |
| and review quarterly.                                  |               |
| Medium                                                 | Head of KIM   |
| Action 3.2                                             |               |
| Taking into account the Target Operating               |               |
| model and KIM strategy, ensure the KIM team has an     |               |
| appropriate structure and skills base to become Centre |               |
| of Excellence for KIM across BIS and its Partner       |               |
| Organisations.                                         |               |
| Medium                                                 | KIM Team      |
| Action 3.3                                             |               |
| Develop a Behavioural Change Strategy to               |               |
| address cultural barriers to good information and      |               |
| records management.                                    |               |
| Low                                                    | KIM Team      |
| Action 3.4                                             |               |
| Develop KIM KPIs and balance scorecard                 |               |
| and monitor quarterly                                  |               |
|                                                        |               |
| Medium                                                 | KIM Team      |
| in pilot stage (May 2014)                              |               |
|                                                        |               |
| Action 3.5                                             |               |
| Working with Partner Organisations develop             |               |
| an Information Management Maturity Model to assess     |               |
| Observations                                           |               |
| Status                                                 |               |
|                                                        |               |

and measure progress in business IM practices and behaviours 
Medium 
KIM Team 
December 2013 
Closed 
 
 
Action 3.6 Set up extranet to facilitate electronic 
collaboration on KIM with stakeholders such as key staff in BIS Partner Organisations 

## Bis To Support Kim Strategy Goals And Vision Through A Consistent And Mutually Supportive Suite Of Policy And Guidance.

To deliver maximum benefit, this policy and guidance should: 
 
Define how KIM strategy outcomes and vision enable the achievement of specific business objectives and BIS Values and Behaviours. 

 
Establish how individuals, the SIRO, deputy SIRO, IAOs and key KIM governance support KIM strategy outcomes. 

 
Be pragmatic, user focused, interrelated and clearly aligned to the technology and business environment. R4 
 
R4 Actions 
Priority: High/Low / Medium 
Owner 
Due for completion 
Medium 
KIM Team 
Q2 2014 - 15 
 
 
Action 4.1 Carry out survey of existing KIM policies and 
guidance 
Medium 
KIM Team 
September 2014   
 
Action 4.2 Working with Ways of Working Team and 
user groups, consult on, design and seek approval for new KIM Policies and Procedures 
High 
Head of KIM 
Q2 2014 - 15 
 
 
Action 4.3 see Action 3.1 (KIM Strategy implementation 
plan) 
Medium 
Comms / KIM Team 
Action 4.4 Review and redesign the intranet to facilitate access to KIM policies and guidance 

## Bis To Build On The Foundations Already In Place For Transparency And Champion Information And Its Management At Management Board Level. R5 This Would Be Supported By:

Observations 
Status 
Q2 2014 - 15 
 
This will be within the constraints of the intranet redesign. KIM team do not have overall control of the  

 
Clear endorsement and support of the Board for the KIM strategy. 
 
Defined reporting requirements for the KIM strategy, including criteria for exception reporting, so the senior team can be kept informed of progress towards goals. 
 
Recognising the KIM team's role in establishing and ensuring the proper use of new systems. 

| R5 Actions                                         | Priority:     |
|----------------------------------------------------|---------------|
| High/Low                                           |               |
| / Medium                                           |               |
| Owner                                              | Due for       |
| completion                                         |               |
|                                                    |               |
| High                                               | Head of KIM   |
| Action 5.1                                         |               |
| Secure Permanent Secretary and                     |               |
| Operations Committee sign-off for the KIM Strategy |               |
| High                                               | Head of KIM   |
| Action 5.2                                         |               |
|                                                    |               |
| See                                                |               |
| Action                                             |               |
|                                                    |               |
| 3.1 (KIM Strategy                                  |               |
| implementation plan)                               |               |
| Action 5.3                                         |               |
|                                                    |               |
| See                                                |               |
| Action                                             |               |
|                                                    |               |
| 3.2 (Centre of Excellence)                         | Medium        |

## Priority Recommen Secondary Recommendations Ations Bis To Engage With The Business To Produce Guidance That Supports Staff To Capture And Manage Information According To Value. This Should Be Embedded Within New Policy And Guidance In Support Of Kim Strategy Aims. The Success Of This Approach Would Be Helped By:

 
Engaging with business units to devise tailored solutions and buy-in of managers. 
 
Ensuring a clear message on what information is ephemeral and should be deleted. 
 
Defining the development and adoption of guidance as a risk reduction activity. 
 
Defining routine capture points for corporate information in support of the KIM strategy aim 'KIM is not an added task, it is how we work', and 
establishing clear rules around file closure to support routine disposal. 

| R6 Actions    |
|---------------|
| Observations  |
| Observations  |
| Status        |
|               |

High/Low / Medium 
Medium 
KIM Team 
Q2 2014 - 15 
 
 
Action 6.1 See Action 4.1 (review policies and 
procedures) 
Medium 
KIM Team 
September 2014 
 
 
Action 6.2  See Action 4.2 (re-issue policies and 
procedures) including *What to keep* guidance and retention and disposal policies 
High 
KIM Team 
January - June 2014 
Action 6.3 Embed new Government Classification 
Scheme across the department 
Action 6.4 See Action 3.3 (Behavioural change) 
Medium 
KIM Team 
June 2014 
 
 
Medium 
KIM Team 
Ongoing 
Ongoing 
 
 
Action 6.5 KIM Partners to embed in business units to 
provide expertise and support the KIM agenda 

## Bis To Ensure Clear Planning And Defined Decisions Around Migration Of Digital Information From Shared Drives And Matrix In Accordance With Value. This Should Include:

 
Defining how technology supports the 'usability' of core information assets. 
 
Establishing how Electronic Records Appraisal project outcomes will be preserved throughout the migration process. In particular, explicit 
reference should be made to digital information already highlighted as having historic value, and action taken to preserve the accessibility and 

context of such records. 

 
Planning to test for complete transfer of context and metadata. 

| R7 Actions                           | Priority:     |
|--------------------------------------|---------------|
| High/Low                             |               |
| / Medium                             |               |
| Owner                                | Due for       |
| completion                           |               |
|                                      |               |
| Action 7.1                           |               |
|                                      |               |
| See                                  |               |
| Action 2.2 (Data migration strategy) | High          |
| Transition                           |               |
| Team                                 |               |
| Action 7.2                           |               |
|                                      |               |
| See                                  |               |
| Action 2.3 (Data migration comms)    | High          |
| Working                              |               |
| Team                                 |               |
|                                      | completion    |
|                                      |               |
|                                      |               |
| Observations                         |               |
| Status                               |               |
|                                      |               |
| November 2013                        | Closed        |
| December 2013                        | Closed        |
Action 7.3 See Action 2.1 (ECM configuration) 
High 
FIMS Project Team 
High 
FIMS Project Team 
Action 7.4 Ensure that robust UAT is carried out to 
preserve the authenticity and accuracy of content and 
metadata migrated to the ECM 

## Bis To Gain Greater Control And Oversight Of The Shared Drives And Information They Contain As It Work To Replace Matrix And Roll Out Its New Technology Environment.

This would be supported by: 
 
Formally defining the risks raised by storing information within an unstructured and uncontrolled environment. 
 
An enforceable policy statement on provision of shared drives and clear guidance on their use where this needs to continue. 

 
Guidance on the discovery of information for business and Freedom of Information Act (FoIA) purposes across multiple repositories ahead of, 
during and following the introduction of the FIMS solution. 
R8 Actions 
Priority: High/Low / Medium 
Owner 
Due for completion 
Action 8.1 See Action 1.2 (risk register) 


Action 8.2 See Action 2.2 (Data migration strategy) 
High 
Business Transition Team 
Action 8.3 FoI and DPA messages are contained within 
the migration and rollout comms, and reinforced in the training for the new ECM. 
Medium 
FIMS Project Team (in conjunction with IRU) 

## R9 Bis To Develop Its Information Asset Management Approach In Line With Kim Strategy Goals, With The Support Of The National Archives.

This requires: 
 
 
Clarity on the delivery of the information asset definition. BIS needs to be clear on type and level of information asset to be captured and focus 
 
on maintaining a manageable Information Asset Register by, for example, splitting it by directorate. 
December 2013 
Closed 
 
Closed 
 
February - April 2014 
Observations 
Status 
November 2013 
Closed 
 
April 2014 
Closed 
 

 
Clear definitions in relation to value, quality and usability and clear reporting requirements. 

 

 
A review of guidance to ensure it supports effective delegation of risk from the SIRO and reflects goals for the protection, management, 

exploitation and re-use of information assets. Guidance should be explicitly alighted with the KIM strategy. 
 
 
R9 Actions 
Priority: High/Low / Medium 
Owner 
Due for completion 
 
Action 9.1 IAR to be sent to TNA for comment  
Medium 
KIM Team 
October 2013 
Closed 
 
 
Medium 
KIM Team 
Q2 2014 - 15 
 
 
Action 9.2 Ensure that IAR aligns with BIS dataset 
inventory and published datasets on data.gov. 
Action 9.3 See Action 4.2 (policies and guidance) 
Medium 
KIM Team 
September 2014   
 
Low 
KIM Team 
June 2014 
 
 
Action 9.4 IAR review and update processes to be formalised  

## Bis To Reinforce Governance Structures For Information Support Roles To Ensure They Can Drive Good Practice In Accordance With Information R10 Policy And Kim Strategy Aims.

 
To support this, BIS should: 
 
 
Define reporting requirements for Information Support Officers (ISOs) to promote policy and good practice. 
 
 
Consider how existing support roles, together with existing project and programme governance structures, can be used to best effect to 
 
support implementation of the KIM strategy before, during and after systems and infrastructure changes. 
R10 Actions 
Priority: High/Low / Medium 
Owner 
Due for completion 
Low 
KIM Team 
September 2014 
 
 
Action 10.1 Carry out review role of Information 
Support Officer and role of ICT super-user 
Low 
KIM Team 
September 2014 


Action 10.2 Develop a BIS Knowledge Council to be headed by SCS Knowledge Champion 
Low 
KIM Team 
September 2014 


Action 10.3 Refresh guidance for specialist users to 
reflect changes in the role 
 
Observations 
Status 
Observations 
Status 

## Bis To Develop A Clear Plan For The Management And Review Of Paper Files To Ensure The Best Use Of Review Team Resources And Limited Available Space.

This should include: 

 
Documenting the file transfer process to support clear communication of roles and responsibilities. 
 
To meet legislative compliance and best practice, BIS should investigate and develop the process for transferring digital information of historic 
value to The National Archives. This should include a methodology for adapting current sensitivity review methodology to digital records. 

| Actions                                              | Priority:     |
|------------------------------------------------------|---------------|
| High/Low                                             |               |
| / Medium                                             |               |
| Owner                                                | Due for       |
| completion                                           |               |
|                                                      |               |
| Medium                                               | KIM Team      |
| Action 11.1                                          |               |
| Revisit the ERA (Electronic Records                  |               |
| Appraisal) process and, once records are on the ECM, |               |
| re-start the transfer of electronic material.        |               |
| Low                                                  | KIM Team      |
| Action 11.2                                          |               |
| Produce documentation of the file transfer           |               |
| process                                              |               |
Observations 
Status