## Action Plan Progress Review Department For Education Contents

 
Background and action plan development  
  
 
  2  
Executive summary  

 3 
Progress to address recommendations and risk areas  
  4 
Next steps 

 

 8 
 

 
© Crown copyright 2017. You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0. Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk

## Background  The Information Management Assessment (Ima) Programme Is The Best-Practice

model for government bodies wishing to demonstrate commitment to the 
principles of good information management.  The Department for Education (DfE) IMA took place in November 2015. The 
National Archives formally assessed progress to address recommendations in June 2017. This progress review summarises key developments since the IMA. 

## Action Plan Development And Delivery

  DfE produced a draft action plan in June 2016. A final redacted version was 
published with the IMA report on The National Archives' website in January 
2017.1  The action plan was owned by the central knowledge and information 
management 
team 
and 
we 
saw 
limited 
evidence 
that 
the 
report's 
recommendations had a department-wide impact. Progress to address recommendations was not scrutinised at a senior level and outcomes from the IMA were not reported to the departmental board as recommended by Sir Alex 
Allan in his 2014 *Records Review*. 2  Now that the IMA is closed, senior support will be essential if DfE is to address 
the reminaing risks and gaps highlighted in this document and build on and embed the positive progress we recognise. 
 Areas where continued attention is still needed are listed below under 'Next 
Steps.' 

## Executive Summary Value Of Information

 The Future Workplace programme has the potential to help DfE to adopt a 
more strategic approach to information and records management. While recognising this and the proposed appointment of a Director General sponsor 
as a potentially **good practice** approach, we emphasise that DfE should have 
an endorsed strategy and guiding vision for information and records management.  
 This is needed to underpin and provide direction for improvement work 
including the relevant components of the Future Workplace programme. DfE should also consider identifying a board level champion for information and records in the long term. 
 DfE has continued to work to improve its ability to manage risks to its 
information assets. 

## Digital Information And Supporting Technology

 DfE has yet to fully define how it will ensure the effective capture, storage and 
management of information and records to meet legal obligations and business requirments in the new IT environment. To prevent the accumulation of a new digital legacy, consideration should be given to proportionate technical controls and restrictions in addition to cultural improvement work. 
 DfE needs to establish concrete plans to ensure that its legacy and current 
digital information remains usable.  

## Information Risk, Governance And Oversight

 DfE has still not formally defined the risk centrally of a failure to deliver 
information and records management outcomes or the impact of a failure to ensure the digital continuity of its information. 
 DfE still lacks a means of monitoring information and records management 
practice. It has no mechanism to routinely surface good practice or to challenge poor practice and encourage improvement.  

## Records Review And Transfer

 DfE has improved oversight of its paper records but still has limited 
understanding of its digital legacy.  
 We are pleased to note that DfE is in the process of developing a forward plan 
for managing the selection and transfer of its paper records for its paper records, factoring in growing volumes to process. It still needs to develop processes for the review, appraisal and transfer of digital information. 

## Progress To Address Recommendations And Risk Areas 1 The Value Of Information

Performance rating 
IMA 2015 
Review 2017 
Satisfactory 
Progressing to Good 
Communicating and realising value  
Satisfactory 
Satisfactory 
Managing information as an asset 
 

 Staff generally recognised that information had value, but were not 
necessarily clear how it should be managed. A draft DfE Information Management Strategy had been produced and was being reviewed by Management Committee to ensure it was focussed effectively.  
 Policy on information asset registration and ownership had been recently 
reviewed. A valuation exercise had been conducted to ensure information assets were properly maintained. DfE needed to build on this work to ensure more consistent oversight and control of its information assets. 
 
 DfE has now embedded knowledge, information and records management as 
one of the three mutually dependent strands of the Future Workplace programme. 
 The programme is intended to change and improve ways of working and the use 
of technology. We noted a positive emphasis on improving culture, removing barriers and engaging and empowering staff. This includes capitalising on 
modern IT and providing staff with the right tools and simpler, more effective 
processes in areas such as email management. 
 While this represents a significant step forward for DfE, we note that the draft 
2015 Information Strategy was not signed off and no successor document has been produced to provide overall focus and direction. Planned meetings with IT to discuss shared strategic priorites have not yet been held. 
 At the time of our meeting, DfE indicated that they had strong senior support for 
the programme and that a formal Director General level sponsor was being sought.  
 The DfE information asset register is now hosted on SharePoint. Retention is 
included among the mandatory fields. DfE recommends that entries are updated at least quarterly. DfE saw an increase in engagement in 2016/17.  
 DfE logs a high number of information assets, using its evaluation model to allow 
the identification by information asset owners of a much smaller core of critical information assets. It has continued to engage with The National Archives' train-
the-trainer programme and is planning to review training provision and enhance awareness through workshops and sharing good practice. 

## 2 Digital Information And Supporting Technology

Performance rating 
IMA 2015 
Review 2017 
Development area 
Development area 
Supporting information through technology 
Development area 
Development area 
Digital continuity and IT change 
 

 The department's on premise SharePoint ERMS, Workplace, was not being 
utilised in accordance with good practice principles for records systems set out in the Section 46 Code of Practice for Records Management. Disposal was not implemented due to inconsistent application of content types and barriers to collaboration existed. A large volume of information was held in Outlook and in archived personal storage table (.pst) files as well as in shared and personal drives. 
 We emphasised the need to look at cultural improvement as well as technical 
controls and barriers when DfE moved to SharePoint Online. 
 DfE was seeking to improve its understanding of its digital information via an 
e-Discovery exercise. IT and IM staff now needed to work together to ensure a detailed understanding of digital continuity risk factors and plan to address them. DfE needed to ensure IM requirements were routinely factored into the IT procurement process. 
 
 Office 365 has been introduced with SharePoint Online rolled out for live users. 
The records centre had not yet been migrated at the time of the review meeting.  
 Personal drives have been made read only and DfE will be pushing staff to 
migrate any content that needs to be retained prior to March 2018, after which it plans to dispose of any remaining material. 
 While this is positive, we saw no evidence that IT and KIM staff had worked out 
an overall agreed model for information and records management in the new IT environment. DfE still needs to define how its business requirements will be met extending from capture and lifecycle management though to the selection and transfer of records with historical value.   
 DfE has not chosen to impose limits on mailboxes or One Drive to help avoid a 
recurrence of the issues it encountered in the previous environment. We note that 5TB of information had been accumulated in the first two months after One Drive's introduction. 
 We are pleased to note DfE's intention to focus on the effective use of search 
and discovery tools in O365. DfE needs however to plan in the long term to ensure that staff both know how to search for information and adhere to good practice in information management. This will help ensure information is readily available across the department and should form a core foundational part of 
plans to encourage exploitation and use of the information it holds.  
 IT and KIM teams are not yet planning collaboratively to enable digital continuity 
outcomes. DfE has considered using The National Archives' Digital Records Object Identification (DROID) software tool, but has not yet deployed it. It has yet to set out any formal plans to address digital continuity risks to current and legacy information. It has also not yet addressed its legacy of pst files. The planned Design Authority offers an avenue to a potential avenue to ensure digital 
continuity as well as information and records management requirements are factored into IT projects. 

## 3 Information Risk, Governance And Oversight

Performance rating 
IMA 2015 
Review 2017 
Satisfactory 
Development area 
Recognising information risk Establishing control 
Development area 
Progressing to satisfactory 
Providing guidance 
Satisfactory 
Satisfactory 
Measuring impact 
Development area 
Development area 

 We saw evidence of business ownership of information and records 
management related risk as required by information risk policy. DfE needed to build on the positive start it had made. This included ensuring information and records management related risks were logged centrally at KIM team and information services unit level.  
 No senior information governance boards were in place to support formal 
collaboration between IT, IM and Information Security units on shared and overlapping priorities. Information and records management services were not fully coordinated and service standards had not been defined. 
 A comprehensive suite of guidance was in place for information and records 
management. We recognised that information management was a component in the mandatory training for Content Managers that was also offered to all new users, but emphasised that more needed to be done to promote and mandate required behaviours. 
 DfE had not defined a process for monitoring information management 
maturity and compliance with corporate policy. 
 No information and records management related risks have been defined and 
logged at KIM team, departmental, directorate or divisional level.  
 DfE still lacks an information focussed governance board or forum to enable 
discussion of shared priorities and promote decision making. The formation of the 
Workplace Transformation board, which will have business representation, represents a step forward, but is unlikely to offer a forum for surfacing wider issues out of scope of the programme.  
 A significant communications plan was delivered focussing on the move to 
SharePoint Online and the introduction of the new intranet. At the time of our meeting there were no plans to extend this. Although it is positive that the KIM team plans to work up a training plan, it was unclear at the time of our meeting 
whether information and records management would be factored into DfE's 
induction programme. 
 DfE has yet to implement any means of monitoring and reporting on adherence to 
information and records management policy. 

## 4 Records, Review And Transfer

Performance rating 
IMA 2015 
Review 2017 
Development area 
Development area 
Oversight of records and selection Implementing disposal decisions 
Development area 
Progressing to Satisfactory 

  
 DfE needed to improve oversight and control of paper and digital records and 
awareness of the Departmental Records Officer role at a senior level. We highlighted the potential impact of team changes on the department's ability to maintain existing standards in appraisal and review, but noted the department's commitment to engaging with support provided by The National Archives. 
 DfE needed to engage with business areas as it worked to define tailored 
department specific retention and disposal schedules. It was working to develop guidance for sensitivity reviewers and needed to seek legal cover for information inherited from other departments relating to Children's Homes while it determined how to review them. DfE needed to engage with The National Archives in developing a forward plan to manage the selection and transfer of growing volumes of paper records and for the transfer of digital records. 
 
 DfE still needs to promote understanding of the DRO's role in leading on 
compliance with the Public Records Act at a senior level.  
 The department still lacks oversight of its digital records,but it has taken a key 
step by engaging with The National Archives to produce a one-year retention 
application for its digital holdings. This was approved at the July 2017 meeting of the Advisory Council. DfE plans to use e-Discovery software to analyse the contents of its shared drives, and help ensure it can meet the requirements of the Independent Inquiry into Child Sexual Abuse. It has not yet defined a clear plan for this work in practice.  
 It also has yet to define an approach for the appraisal, sensitivity review and 
transfer of digital records and at the time of the review meeting had not produced 
work plans in line with its retention application. 
 However, we are pleased to recognise that DfE does have a better understanding 
of its paper holdings than at the time of the IMA. It produced a statement on paper holdings in 2017 and is now in the process of drafting an 18-month end-toend transfer plan. This reflects The National Archives' gateways and Series Level Time Plan processes and has the potential to provide a good basis for monitoring and controlling transfers once finalised and agreed.  It is now supporting efficient and effective selection process through the use of Series Level Appraisal Questionnaires. DfE is aware that the volume of its paper holdings increases significantly from 1995 onwards and is seeking to schedule review work accordingly, with review of records due for transfer in 2018 already underway.   
 

## Next Steps

The National Archives will continue to support the Department for Education in its work on information and records management so that it is supported through to the time of its next IMA. In the interim, we recommend that the following points are focussed on and built into departmental business planning: 

 Support continued improvement and development of its approach for managing 
digital information by establishing an agreed strategic vision for information and records management. DfE will need to define how good practice in knowledge, information and records management will be achieved and maintained beyond completion of the Workplace Modernisation programme. There would be benefit in appointing a board-level champion. 
 Define a practical model of how information and records management should be 
delivered in the new IT environment. DfE should consider the use of proportionate technical controls and restrictions as well as cultural and behaviourally focussed work to help shape information and records management practice in Office 365. 
 Formally define and log the risk to the department of a failure to manage 
information and records appropriately and a failure to ensure their availability and usability.  
 Establish a rolling communications plan to encourage and promote adherence to 
good practice principles. 
 Establish an information focussed governance board to support joined-up 
working once the Workplace Modernisation programme has completed. 
 Set up a mechanism to monitor information management practice, drawing on 
good practice examples from the IMA programme including those that are in place within HM Treasury and Home Office.  
 Continue to engage with The National Archives to systematically map out future 
arrangements for appraisal, sensitivity review and transfer of paper records, with a view to placing these on a formal agreed footing, ideally through to the end of 
the transition period for the 20-year rule in 2023. 
 Define its approach for the appraisal, selection and transfer of digital records, 
ensuring that in depth analysis of digital holdings is conducted, including identification of the earliest born-digital records. DfE should seek advice and support from The National Archives in its use of e-Discovery software and deployment of DROID. 
 Ensure that IM requirments including digital continuity are considered as a 
component of the procurement process. DfE should engage with The National Archives to develop a plan to support the ongoing continuity of digital information and management of risks related to its existing digital legacy. This would include putting in place processes to ensure that its digital legacy does not reaccumulate.