Criminal Records Bureau Information Management Assessment Programme Action Plan 
 
# 
Recommendation 
Actions 
Priority High/Low/ Medium 
High 
August 2012 
Business Integrity Unit 
Action 1.1 Work is currently 
underway to address the issue of CRM data retention with business units so that this can be filtered to the Contract Re-let requirements. A policy has been drafted and has been formally approved by ET August 2012. 
R1 
1.Evaluate the risk, 
benefit and cost of disposing of personal information that is no longer required in the Customer Relationship Management system, with a view to deleting this prior to the 
anticipated merger with 
 
ISA. 
 
High 
Update action November 2012  
Action 1.2 The second Stage of 
work is also underway with regards to the transfer of the data at the end of the current Capita contract. Two options are to be considered; transfer the data in its entirety or to purge the data in line with the agreed Retention Policy before transfer.  
 
High 
August 2012 
Business Integrity Unit 
Action 1.3 A CRB specific 
Corporate File Plan retention policy has been drafted in conjunction with all CRB Records 
Advisors.  
Timescale 
Owner 
Observations 
Delivered? Yes/No 
Completed  
The Records management team have been in communications with the business in establishing what the requirements are for this data. 
Ongoing 
Business Integrity Unit 
This will also form part of discussions with the selected supplier as part of their data migration plans. 
Ongoing 
This was presented to CRB ET August 2012 with the CRM policy as per 1.1 for formal approval and agreement has now been given to implement. Actions are being taken forward with 
Records Advisors. 
| Medium                               | Update action    |
|--------------------------------------|------------------|
| November                             |                  |
| 2012                                 |                  |
| R2                                   |                  |
| 2.                                   |                  |
|                                      |                  |
| Develop a CRB                        |                  |
| specific Information                 |                  |
| Management plan.                     |                  |
|                                      |                  |
|                                      |                  |
| Action 2.1:                          |                  |
| CRB currently report                 |                  |
| against the HO IM strategy every     |                  |
| quarter. CRB will develop a plan to  |                  |
| underpin the key principles          |                  |
| including where we currently are     |                  |
| and where we need to be              |                  |
|                                      |                  |
|                                      |                  |
|                                      |                  |
|                                      |                  |
|                                      |                  |
| R3                                   |                  |
| 3. Expand the scope of               | Medium           |
| 2012                                 |                  |
| the                                  | Information      |
| Register (IAR) to create             |                  |
| a                                    | tool             |
| information                          |                  |
| Action 3.1:                          |                  |
| The CRB IAR has                      |                  |
| recently been updated to capture a   |                  |
| number of key pieces of              |                  |
| information including criticality,   |                  |
| purpose and retention. This          |                  |
| recommendation will form part of a   |                  |
| larger piece of work and will form   |                  |
| part of transition arrangements.     |                  |
|                                      |                  |
| management.                          |                  |
|                                      |                  |
|                                      |                  |
| Action 3.2:                          |                  |
| Amendments to the                    |                  |
| register to be made when             |                  |
| agreement has be reached.            |                  |
|                                      |                  |
|                                      |                  |
|                                      |                  |
| Medium                               | See Notes        |
| date TBC by                          |                  |
| R4                                   |                  |
| 4.Develop                            | key              |
| Action 4.1:                          |                  |
| The Data Protection                  |                  |
| Officer has raised the monitoring of |                  |
| Ongoing               | Business    |
|-----------------------|-------------|
| Integrity Unit        |             |
| The current Home      |             |
| Office Information    |             |
| Management            |             |
| Strategy plan will    |             |
| feed into this. DPO   |             |
| to draft a high level |             |
| policy which will     |             |
| draw together the     |             |
| main principles of    |             |
| the HO strategy and   |             |
| also the              |             |
| recommendations of    |             |
| this report.          |             |
| Consideration will    |             |
| also be given to the  |             |
| implications of the   |             |
| merger ie Data        |             |
| Migration.            |             |
| Discussion is         |             |
| ongoing with the      |             |
| Home Office with      |             |
| regards to what the   |             |
| current CFP will look |             |
| like on day one of    |             |
| DBS.                  |             |
|                       |             |
| Ongoing               | Business    |
| Integrity Unit        |             |
| As per action 2.1 the |             |
| arrangements for the  |             |
| CFP structure is yet  |             |
| to be agreed. The     |             |
| continuity of         |             |
| applicant data        |             |
| (CRM) will form part  |             |
| of the transition     |             |
| arrangements.         |             |
| Ongoing               | Business    |
| Integrity             |             |
| HO are currently      |             |
| piloting a number of  |             |
| performance                         | indicators    |
|-------------------------------------|---------------|
| (KPIs) to monitor use of            |               |
| Corporate                           | File          |
| (CFP) and monitor these             |               |
| at board level.                     |               |
|                                     |               |
| the CFP with the HO as reporting    |               |
| information relating to the CFP can |               |
| only be provided via the Home       |               |
| Office IMS team. The reporting      |               |
| mechanism is currently under        |               |
| review and a KPI has been           |               |
| included as part of the ARO work.   |               |
| .                                   |               |
|                                     |               |
|                                     |               |
|                                     |               |
| High                                | Ongoing       |
| Integrity Unit                      |               |
| Action 4.2:                         |               |
| The Data Protection                 |               |
| Officer is currently undertaking an |               |
| exercise with staff across the      |               |
| Agency to reduce G drive space      |               |
| highlighting that business related  |               |
| information must be stored in the   |               |
| CFP.  Updates regarding this        |               |
| exercise are reported in the        |               |
| monthly Business Integrity Unit     |               |
| HO                      | Unit/IMS    |
|-------------------------|-------------|
| which include           |             |
| -Levels of folders by   |             |
| filepath                |             |
| -Numbers of folders     |             |
| by filepath             |             |
| -Number of files by     |             |
| filepath                |             |
| -CFP filepaths where    |             |
| documents and           |             |
| records are not the     |             |
| lowest level            |             |
| -CFP documents          |             |
| folders that do not     |             |
| have the specific       |             |
| permission applied      |             |
| to prevent illegal      |             |
| folders.                |             |
| -Date last              |             |
| accessed/modified       |             |
| by filepath             |             |
|                         |             |
| These will all start to |             |
| show how much the       |             |
| CFP is being used       |             |
| and where it is being   |             |
| used incorrectly.       |             |
|                         |             |
| On success of the       |             |
| pilot this will b a     |             |
| service rolled out to   |             |
| CRB.                    |             |
|                         |             |
| Ongoing to              |             |
| be                      |             |
| completed               |             |
| ahead of                |             |
| DBS being               |             |
| set-up                  |             |
| 30/11/12                |             |
| DPO currently           |             |
| monitors G drive        |             |
| size on a quarterly     |             |
| basis to ensure staff   |             |
| are storing corporate   |             |
| information             |             |
| accordingly in the      |             |
| CFP. There are only     |             |
| a small number of       |             |
| staff who the DPO is    |             |
| working with to         |             |
(BIU) report which the Director of Change & Business Integrity 
reports to the Executive Team. Medium 
R5 5.Evaluate and assess how best to utilise Records Advisors to promote and monitor information management good practice. 
 
Action 5.1: The Records Advisor 
(RA) network has been strengthened in line with the Information Asset Owner Network. The Head of BIU now chairs a quarterly meeting and the Data Protection Officer holds a monthly meeting whilst the retention and EDRM projects are ongoing. 
Records Advisors are key representatives in all business areas and are seen as the main local contact for CFP related issues. This is also reflected as an objective in their PDRs.  
 
complete this for the latest quarter. Immediate Complete Business Integrity Unit Internal Comms have been issued via team brief articles. Records Advisor network has been expanded. RA training was delivered in July for all new and existing RAs. 
Monthly meetings take place with RAs. Head of BIU currently chairs a quarterly meeting. Home Office have delivered some RA 
training on site 12th 
June 2012. DPO will also assess the suitability of supplementing RA training with the elements of that delivered to IAOs.  
| Medium                               | Immediate                 | Business                  |
|--------------------------------------|---------------------------|---------------------------|
| Integrity Unit                       |                           |                           |
| Action 5.2:                          |                           |                           |
| The mandatory staff                  |                           |                           |
| training now includes a section      |                           |                           |
| relating to the role of the RA, this |                           |                           |
| was further highlighted in a team    |                           |                           |
| brief article May/June 2012          |                           |                           |
|                                      |                           |                           |
| Medium                               | Immediate                 | Business                  |
| Integrity Unit                       |                           |                           |
| Action 5.3:                          |                           |                           |
| The Head of BIU acts                 |                           |                           |
| as the Agency Records Officer        |                           |                           |
| (ARO), nominated by the CEO,         |                           |                           |
| and as such sits on the Home         |                           |                           |
| Office ARO Forum. The Forum has      |                           |                           |
| developed a number of KPIs for       |                           |                           |
| areas such as retention, G drive     |                           |                           |
| usage, number of registered paper    |                           |                           |
| files.                               |                           |                           |
|                                      |                           |                           |
| R6                                   |                           |                           |
| 6.Implement a coherent               |                           |                           |
| Action 6.1:                          |                           |                           |
| The mandatory annual                 |                           |                           |
| refresher                            | training                  | has                       |
| Medium                               | Immediate                 | Business                  |
| Integrity Unit                       |                           |                           |
| programme of training                |                           |                           |
| and                                  | a                         | review                    |
| amended to reflect feedback from     |                           |                           |
| within                               | the                       | report                    |
| guidance                             | available                 | to                        |
| raise                                | the                       | information               |
| management capabilities              |                           |                           |
| definitions, Section 46 Code of      |                           |                           |
| Practice. The sessions will also     |                           |                           |
| reinforce the message to reflect     |                           |                           |
| the issue of CFP usage and G         |                           |                           |
| Drive storage.                       |                           |                           |
| of staff.                            |                           |                           |
| Medium                               | July 2012                 | Business                  |
| Integrity Unit                       |                           |                           |
|                                      |                           |                           |
| Action 6.2:                          |                           |                           |
| Records Management                   |                           |                           |
| /Data Protection communications      |                           |                           |
| are now included in the Security     |                           |                           |
| Annual Circular and                  |                           |                           |
| Policy/Procedure reviews to          |                           |                           |
| ensure messages are cascaded on      |                           |                           |
| a regular basis.                     |                           |                           |
|                                      |                           |                           |
|                                      |                           |                           |
|                                      |                           |                           |
| R7                                   |                           |                           |
| 7.Evaluate the possibility           |                           |                           |
| Action 7.1:                          |                           |                           |
| As part of the G drive               |                           |                           |
| Medium                               | Immediate                 | Business                  |
|                                      |                           |                           |
| Signed: _________________________    | _________________________ | _________________________ |
| Complete                | Team brief articles    |
|-------------------------|------------------------|
| will be refreshed on    |                        |
| a quarterly basis.      |                        |
| Mandatory Annual        |                        |
| Staff Information       |                        |
| Management              |                        |
| Training has now        |                        |
| been delivered          |                        |
| May/June 2012 with      |                        |
| a new section           |                        |
| incorporating all the   |                        |
| points detailed in the  |                        |
| report.                 |                        |
| Complete                | The CFP reports as     |
| highlighted in          |                        |
| recommendation 4        |                        |
| will also monitor this. |                        |
| Complete                | As above the           |
| additional training     |                        |
| will also be delivered  |                        |
| as part of the Home     |                        |
| Office EDRM system      |                        |
| implemented.            |                        |
|                         | Complete               |