1 Establish a programme of work to establish and embed the right information management culture in the new IT environment. This 
should be closely integrated with planned IT change. 
 Drawing on good practice examples of work to improve culture and behaviours from organisations in the IMA programme, including 
HM Treasury and Welsh Government. 
 Appointing an overall board-level champion for information and records management to lend support to planned initiatives. 
 
Ensuring a focus on recognised issues and risk areas such as improving how staff work with and manage email, the retention of drafts and key context, and the unnecessary capture and retention of ephemeral material. 
 
 DfT has been through an intense period of technology change in the past year with new hardware and software being rolled out to staff. Culture change around the rollout of TiME is ongoing and the arrival of new tools such as One Note, One Drive etc and the O365 phase 2 project means that work around this is adapting and changing against a backdrop of constantly shifting sands. KIM team is working hard to ensure that it is represented on the right projects, that it talks to the right people within Digital Services, that the right messages are being promoted and that it is listening to feedback from users and using this to help shape the way forward. Commentary last updated: April 2019  

 
 Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status Done 
December 2019 
Identify senior KIM champion 
Head of KIM/DRO and DS senior team 
Director, Major Rail Project Development given the role of Senior KIM Champion with the support of the Permanent Secretary Senior KIM Champion has joined the IMM programme board. His input from a business perspective has been invaluable so far, as his business area was one of the early adopters of TiME. Head of KIM meets with Senior KIM Champion and together are exploring other ways of supporting KIM across DfT.   
 
Ongoing 
Ongoing 
Strengthen SIRO responsibility by delivering SIRO briefings 
Head of KIM/DRO and CISO 
New Chief Information Security Officer (KIM reports into the CISO) arrived in October he is shaping plans to better raise awareness of information risks to the SIRO. Our work as part of the Better Information for Better Government information risk work will also help us to better articulate information management risks and severity. 
Ongoing 
Ongoing 
Develop a Behavioural Change Charter/Strategy  
KIM team, IMM team, Change 
Manager 
Whilst we haven't developed a charter/strategy there has been significant progress here. 
User research took place in autumn 2019 with teams who had already had TiME rolled out in order to understand their user experience, any sticking points and positives. The results of this were reported into the IMM project Board and used to improve the migration process. Digital Adoption team recruited a Change Manager (arrived late 2018) who is now supporting the IMM project. Is working on ways of measuring how successful the project has been in changing behaviours. Behavioural change is a key part of the process of migration to TiME. This is covered in early engagement with business areas including senior managers and Project Champions and Local Information Managers are encouraged to promote this. It is also covered in the training and guidance. 
| Ongoing                                                | Ongoing    | KIM Policy &                               |
|--------------------------------------------------------|------------|--------------------------------------------|
| Engagement                                             |            |                                            |
| Ensure that KIM requirements are taken into            |            |                                            |
| account on projects that impact on physical or         |            |                                            |
| digital information.                                   |            |                                            |
| KIM is now represented on the Digital Design           |            |                                            |
| Authority (DDA). The DDA has been set up so that all   |            |                                            |
| new technologies or substantial projects to            |            |                                            |
| introduce new information management tools are         |            |                                            |
| discussed before they are installed/developed.         |            |                                            |
|                                                        |            |                                            |
| KIM is also represented on the O365 phase 2 project    |            |                                            |
| which is looking at the next phase of rollout          |            |                                            |
| including Teams, planner etc. Also involved with       |            |                                            |
| work to set up IM solutions for ICCAN and Disabled     |            |                                            |
| Persons Transport Advisory Committee.                  |            |                                            |
|                                                        |            |                                            |
| Head of KIM presented at a recent Project              |            |                                            |
| Management Office network meeting on KIM and           |            |                                            |
| the importance of managing project records. KIM        |            |                                            |
| team has a representative on this network too.         |            |                                            |
|                                                        |            |                                            |
|                                                        |            |                                            |
| Ongoing                                                | Ongoing    | Review and refresh guidance on What, Where |
| and Why to keep corporate records                      |            |                                            |
| KIM Policy &                                           |            |                                            |
| Engagement                                             |            |                                            |
| As the department moves to cloud services for its      |            |                                            |
| information holdings, many different tools are being   |            |                                            |
| rolled out.  Guidance will need to reflect these areas |            |                                            |
| once their proposed purpose has been defined.          |            |                                            |
|                                                        |            |                                            |
| KIM team has started reviewing guidance on My DfT.     |            |                                            |
| What to keep, why and where is covered in training     |            |                                            |
| that business areas received as part of process of     |            |                                            |
| migrating to TiME and in guidance. Also covered in     |            |                                            |
| engagement activities such as blog produced by         |            |                                            |
| Head of KIM (Dec 2018), presentation at policy week    |            |                                            |
| and to PMO.                                            |            |                                            |
|                                                        |            |                                            |
|                                                        |            |                                            |
KIM is engaging with the Digital Adoption team as they provide training in O365 tools such as One Drive and One Note to ensure that this is aligned with KIM requirements on what to . Aim to provide guidance to give a steer around the use of tools outside our designated corporate systems such as Trello but not started yet due to other priorities. 
KIM Policy & Engagement 
End 2019 
To start Summer 2018 
Produce an information management toolkit explaining the information/user lifecycle and 
what is required when. 
Work has started to review existing KIM guidance and identify gaps. Progress has slowed due to the 
demands of other projects such as IMM and staff shortage. We also need to take account of impact of other projects such as O365 and ensure that our messages are aligned.   

## 2 Establish And Communicate A Clear Vision And Strategy For Information Management.

 
Using the information management modernisation project's future information principles as a starting point. 
 Adopting a format-blind approach that encompasses data and records management outcomes.  Establishing concrete plans to socialise and implement the strategy. 
 
Work on the strategy was been delayed due to staff changes. New Head of KIM/DRO recruited in June 2018 and work on strategy started in Autumn 2018. Progress slightly slower than planned due to the reshaping of the IMM project and consideration of how the KIM and Digital Technology can be better aligned. Our Permanent Secretary is bought into the importance of good knowledge and information management as demonstrated by her commitment to supporting the Better Information for Better Government programme. Commentary last updated:  April 2019 
 

|  Enabling/supporting actions                           | Owner    | Commentary on progress    |
|--------------------------------------------------------|----------|---------------------------|
| due                                                    |          |                           |
| Status                                                 |          |                           |
|                                                        |          |                           |
| Spring 2019                                            |          |                           |
|                                                        |          |                           |
| In progress                                            |          |                           |
|                                                        |          |                           |
| Head of                                                |          |                           |
| KIM/DRO                                                |          |                           |
| Draft a KIM Strategy and ensure that it aligns         |          |                           |
| with other strategies (for example, Digital            |          |                           |
| Strategy, IMM Future Information Principals            |          |                           |
| )                                                      |          |                           |
| to                                                     |          |                           |
| form a unified and coherent approach to                |          |                           |
| information management.                                |          |                           |
|                                                        |          |                           |
| Strategy drafted (taking into account IMM future       |          |                           |
| info principles) and currently with Digital            |          |                           |
| Architecture team for comment. In talks with DA to     |          |                           |
| consider possibility of incorporating KIM strategy as  |          |                           |
| part of the wider Digital Technology Strategy or at    |          |                           |
| least ensure that the two strategies are aligned.      |          |                           |
| Senior KIM champion has offered to do a workshop       |          |                           |
| with the KIM team on the strategy to see how he can    |          |                           |
| help.                                                  |          |                           |
|                                                        |          |                           |
| Not identified                                         |          |                           |
|                                                        |          |                           |
| Not yet started                                        |          |                           |
|                                                        |          |                           |
| Gain senior sign off for the KIM Strategy and          |          |                           |
| publish and communicate.                               |          |                           |
| Head of                                                |          |                           |
| KIM/DRO                                                |          |                           |
|                                                        |          |                           |
| Depends on whether this is incorporated into DT        |          |                           |
| strategy as above. CIO would likely sign off the       |          |                           |
| strategy but he is leaving DfT and will be a caretaker |          |                           |
| leader for the foreseeable future.                     |          |                           |
| Spring 2019                                            |          |                           |
|                                                        |          |                           |
| In progress                                            |          |                           |
|                                                        |          |                           |
| Head of                                                |          |                           |
| KIM/DRO                                                |          |                           |
| Develop an implementation plan for the KIM             |          |                           |
| Strategy and decide how success will be                |          |                           |
| monitored and how progress will be reported.           |          |                           |
| Activities in order to implemement strategy have       |          |                           |
| been identified and are included with the strategy.    |          |                           |
| These will be incorporated into KIM business plan      |          |                           |
| and KIM team objectives for 2019/20                    |          |                           |
|                                                        |          |                           |
|                                                        |          |                           |
|                                                        |          |                           |
| End 2019                                               |          |                           |
|                                                        |          |                           |
| In progress                                            |          |                           |
|                                                        |          |                           |
| Using the Information Management Self-                 |          |                           |
| Assessment tool work with the Agencies to              |          |                           |
| implement and co-ordinate the action plans             |          |                           |
|                                                        |          |                           |
| Head of                                                |          |                           |
| KIM/DRO,                                               |          |                           |
| Agency                                                 |          |                           |
| Records                                                |          |                           |
| Officers                                               |          |                           |
| DfTs Executive Agencies are in the process of          |          |                           |
| completing the IM Self Assessment tool. Agency         |          |                           |
| Records Officers to use results to produce action      |          |                           |
| plans. Share and capitalise on good practice           |          |                           |
| approaches.                                            |          |                           |
|                                                        |          |                           |
|                                                        |          |                           |
|                                                        |          |                           |
|                                                        |          |                           |
|                                                        |          |                           |
|                                                        |          |                           |
|                                                        |          |                           |
 

3 Apply continued focus to the delivery of an improved IT environment that will make good information management practice easier to 
achieve. 
 Formally establishing the link between the information management modernisation project and the forthcoming roll out of the wider 
Office 365 environment. 
 Adopting a whole IT environment approach to information architecture and information capture and storage, with consideration 
given to proportionate use of controls to help shape behaviours and limit the potential for bad practice. 
 
Much of the KIM teams focus in 2017 was on the development of TiME which has impacted on its ability to carry other KIM work.  As a result a separate team was  temporarily established  to lead on the rollout of TiME and migration. It is a formal project with a Senior Responsible Owner and the Project Board includes representatives from across the business and meets monthly. The KIM team still has overall ownership of TiME both in terms of policy and development and business as usual support and is  closely involved with the work. Personnel changes within the IMM team have put some pressure on project delivery as have other department priorities (which have impacted on business area engagement) and the opportunity was taken in late 2018/early 2019 to review the project and make some changes to our approach in order to ensure we delivered the outcomes stated in the business case. This has meant that KIM team resource has once again been drafted into IMM reducing the time we have to spend on other tasks such as the KIM strategy and guidance. Steps have been taken to ensure that the IMM project is aligned with the O365 project and KIM is represented on the latter. Commentary last updated: April 2019 

 
 Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
Summer 2019 
In progress 
Roll out TiME across DfT(c)  
IMM project team, KIM 
team 
A plan for migration has been put together and rollout has now started. The IMM project team is leading on this with input from the KIM team. Migration leads are working with business areas to analyse their information and file structures to prepare to migrate. DfT is working with Automated Intelligence (AI) to facilitate this. 
| In progress                                            | KIM Services                                |
|--------------------------------------------------------|---------------------------------------------|
| &                                                      |                                             |
| Compliance                                             |                                             |
|                                                        |                                             |
| Ongoing - will                                         |                                             |
| progress in line                                       |                                             |
| with TiME                                              |                                             |
| rollout                                                |                                             |
| Make shared drives Read Only as information is         |                                             |
| analysed and migrated into TiME or other data          |                                             |
| repositories. Have an audit process in place to        |                                             |
| ensure appropriate treatment of locked down            |                                             |
| information i.e. Transfer to TNA or destruction is     |                                             |
| carried out.                                           |                                             |
| Shared drives are locked down as information is        |                                             |
| migrated into TiME.  The project team will pass        |                                             |
| information on the categorisation of information in    |                                             |
| the shared drives to the KIM team to enable to         |                                             |
| ongoing management of information which needs to       |                                             |
| be retained in line with retention.                    |                                             |
| In progress                                            | DRO + KIM                                   |
| Policy &                                               |                                             |
| Engagement                                             |                                             |
| Work with Digital Architecture team to                 |                                             |
| understand the future O365 offering and have           |                                             |
| clear mandate for each of the O365 applications,       |                                             |
| alongside clear KIM Governance.                        |                                             |
| KIM team has representation on the O365 phase 2        |                                             |
| project and is working closely with the digital        |                                             |
| architecture team on what each app should be used      |                                             |
| for. DfT is also part of the cross government task and |                                             |
| finish group on policies around O365 apps which will   |                                             |
| help to shape DfTs approach to this.                   |                                             |
| Currently                                              |                                             |
| March 2019,                                            |                                             |
| however this                                           |                                             |
| work will                                              |                                             |
| progress in line                                       |                                             |
| with the O365                                          |                                             |
| project                                                |                                             |
| Complete                                               | Implement tools, guidance and processes for |
| effective email management.                            |                                             |
| KIM Policy &                                           |                                             |
| Engagement                                             |                                             |
| September                                              |                                             |
| 2018                                                   |                                             |
| Included as part of the new TiME offering is the AI    |                                             |
| SyncPoint tool which integrates TiME with Outlook,     |                                             |
| allowing users to save and file emails more easily. As |                                             |
| part of the rollout plan users are invited to          |                                             |
| classroom training which shows how it works as well    |                                             |
| as explaining the benefits to the department and       |                                             |
| user in IM. Further guidance to highlight processes    |                                             |
| and benefits will be produced and published on My      |                                             |
| DfT.                                                   |                                             |
| Ongoing                                                | In progress                                 |
| architecture in SharePoint platform.                   |                                             |
| KIM Policy &                                           |                                             |
| Engagement                                             |                                             |
| DfT rolled out SharePoint 'Classic view' to the pilot  |                                             |
| users in 2018, however the SharePoint offering is      |                                             |
| now the 'Modern view' and the IMM and KIM team         |                                             |
| have made substantial changes to the information       |                                             |
| architecture in line with this move. As new aspects of |                                             |
| SharePoint are introduced i.e. Teams and Planner       |                                             |
| the information architecture will be determined and    |                                             |
| implemented at that time. KIM team is part of the      |                                             |
| O365 Phase 2 project where a lot of the discussions    |                                             |
| around this are happening.                             |                                             |
|                                                        |                                             |
| March 2018                                             |
|--------------------------------------------------------|
| Engagement                                             |
| Implement 'Open by Default' policy on new              |
| information management platforms, with                 |
| appropriate controls where necessary.                  |
| The TiME system has been set up to ensure              |
| information is 'Open by Default'. As information is    |
| migrated, sensitive areas are identified and           |
| restricted permissions are put in place to protect it. |
| All other information is 'open' to allow better        |
| collaboration and greater transparency across the      |
| department.                                            |
|                                                        |
| Ongoing                                                |
|                                                        |
| In progress                                            |
|                                                        |
| DRO and KIM                                            |
| Policy and                                             |
| Engagement                                             |
|                                                        |
| Work with digital architecture team to discover        |
| what other online tools are being used across          |
| DfT (for example, Trello) and decide on                |
| governance approach.                                   |
| Some early discussions with the architecture team,     |
| digital adoption and security colleagues on this. Will |
| need to produce policies and guidance around this.     |
|                                                        |
|                                                        |

 
4 
Build on the work to embed digital continuity as part of the proposed information principles, putting in place concrete plans for KIM and IT staff to deliver digital continuity and information management priorities. 
 Ensuring digital continuity principles are applied to the whole IT environment, including the wider Office 365 environment, current 
and legacy email holdings. 
 Ensuring that consideration of retention and digital continuity are factored into the IT procurement process as standard.  Putting in place a clear policy in relation to the migration of information at risk of digital continuity loss including non-identifiable 
formats. 
[Commentary on progress against main recommendation heading] Commentary last updated: April 2019 
 

|  Enabling/supporting actions                         | Owner                                    | Commentary on progress                           | Completion                                         |
|------------------------------------------------------|------------------------------------------|--------------------------------------------------|----------------------------------------------------|
| due                                                  |                                          |                                                  |                                                    |
| Status                                               |                                          |                                                  |                                                    |
|                                                      |                                          |                                                  |                                                    |
| March 2019                                           | In progress                              | Carry out a digital obsolescence review and take |                                                    |
| action where necessary                               |                                          |                                                  |                                                    |
| KIM Service                                          |                                          |                                                  |                                                    |
| and                                                  |                                          |                                                  |                                                    |
| Compliance                                           |                                          |                                                  |                                                    |
| Scan of all drives has been carried out and this has |                                          |                                                  |                                                    |
| identified the formats used in DfT systems.          |                                          |                                                  |                                                    |
|                                                      |                                          |                                                  |                                                    |
| The resulting report is now with KIM Policy &        |                                          |                                                  |                                                    |
| Engagement to research options and produce a plan    |                                          |                                                  |                                                    |
| of action for the most vulnerable material.          |                                          |                                                  |                                                    |
| March 2019                                           | In progress                              | Email archive plan to be created and             |                                                    |
| implemented.                                         |                                          |                                                  |                                                    |
| KIM Policy                                           |                                          |                                                  |                                                    |
| and                                                  |                                          |                                                  |                                                    |
| Engagement                                           |                                          |                                                  |                                                    |
| Ongoing discussions around this difficult issue. A   |                                          |                                                  |                                                    |
| paper was presented to the Digital Service Board in  |                                          |                                                  |                                                    |
| September and a risk was included on the O365        |                                          |                                                  |                                                    |
| project risk register. Still working to agree a way  |                                          |                                                  |                                                    |
| forward. Plan to raise a risk to SIRO on this.       |                                          |                                                  |                                                    |
|                                                      |                                          |                                                  |                                                    |
|                                                      |                                          |                                                  |                                                    |
| Not yet started                                      | Ensure KIM team aware of spend controls. | KIM Team                                         | Organise a session with Digital Spend control team |
|                                                      |                                          |                                                  |                                                    |
| September                                            |                                          |                                                  |                                                    |
| 2018                                                 |                                          |                                                  |                                                    |
| End 2018                                             | Complete                                 | KIM team to be invited to attend O365 project    |                                                    |
| boards.                                              |                                          |                                                  |                                                    |
| KIM is now represented on the O365 Phase 2 project   |                                          |                                                  |                                                    |
|                                                      |                                          |                                                  |                                                    |
| DRO & KIM                                            |                                          |                                                  |                                                    |
| Policy and                                           |                                          |                                                  |                                                    |
| Engagement                                           |                                          |                                                  |                                                    |
| Ongoing                                              | In progress                              | Implement a Data Migration Strategy from         |                                                    |
| shared drives to O365 and other cloud platforms.     |                                          |                                                  |                                                    |
| DS senior                                            |                                          |                                                  |                                                    |
| team and                                             |                                          |                                                  |                                                    |
| DRO                                                  |                                          |                                                  |                                                    |
| Google Cloud Platfotm project has now kicked off.    |                                          |                                                  |                                                    |
| KIM team are working to ensure to ensure that KIM    |                                          |                                                  |                                                    |
| requirements are taken into account throughout.      |                                          |                                                  |                                                    |
|                                                      |                                          |                                                  |                                                    |
| Ongoing                                              | In progress                              |                                                  |                                                    |
|                                                      |                                          |                                                  |                                                    |
| Investigate the use of digital tools to help         |                                          |                                                  |                                                    |
| analyse and tackle the digital heap.                 |                                          |                                                  |                                                    |
|                                                      |                                          |                                                  |                                                    |
| KIM Policy                                           |                                          |                                                  |                                                    |
| and                                                  |                                          |                                                  |                                                    |
| Engagement                                           |                                          |                                                  |                                                    |
| DfT KIM team has additional tools available to them  |                                          |                                                  |                                                    |
| to analyse the shared drives. These are functional   |                                          |                                                  |                                                    |
| rather than intelligent tools.                       |                                          |                                                  |                                                    |
|                                                      |                                          |                                                  |                                                    |
| The KIM team will work with Information Assurance    |                                          |                                                  |                                                    |
| colleagues to understand the market and options      |                                          |                                                  |                                                    |
| available.                                           |                                          |                                                  |                                                    |
|                                                      |                                          |                                                  |                                                    |
O365 has inbuilt tools/reports that will provide analysis of activities and formats but additional tools will be required 
Look at what other departments are starting to do here including Cabinet Office with AI data lift. Draw on any available advice and guidance from The National Archives/Better Information for Better 
Government programme  

 
5  Review corporate descriptions of information and records management related risk to ensure causes and mitigating actions reflect the 
wider current and future IT environment, including the planned introduction of Office 365. 
 Reviewing the impact and likelihood of the risk and ensuring scrutiny at a directorate as well as a divisional level.  Updating the information risk policy to provide a clear steer on information and records management related risk, including 
structures and roles for managing it. DfT should consider extending this to business ownership of compliance related risk, drawing on best practice examples that already exist within the department. 
 Defining the risks related to digital continuity and logging these at an appropriate level.  Ensuring the role of information and records management is factored into definitions of other information related risks including 
those relating to cyber security and loss of personal and sensitive information. Also incorporating Recommendation 7 
Build on the existing information asset governance framework and seek opportunities to surface and manage information and records management related risks to information assets. 
 
Ensuring KIM and information assurance staff work together to ensure risks relating to disposal of information assets are identified and 
monitored. 
 Ensuring KIM and information security staff work together to identify and monitor risks relating to digital continuity of information 
assets and datasets, especially bespoke data sets held outside the core system that needs to be held over the long term. 
 
 Information Assurance team has been very short staffed and mimimal progress has been made on the first few actions. However, a new Critical Assets Manager has been recruited which should help move things forward here. KIM team has made some progress on the risk side of things through its work on the BI4BG information risk working group. Commentary last updated: April 2019 
 

|  Enabling/supporting actions                       | Owner       | Commentary on progress                         |
|----------------------------------------------------|-------------|------------------------------------------------|
| due                                                |             |                                                |
| Status                                             |             |                                                |
|                                                    |             |                                                |
| Ongoing                                            | Not started |                                                |
|                                                    |             |                                                |
| Review DfTs corporate information risk profile     | DS Senior   |                                                |
| team,                                              |             |                                                |
| Information                                        |             |                                                |
| Assurance                                          |             |                                                |
| and DRO                                            |             |                                                |
| Ongoing                                            | Not started |                                                |
|                                                    |             |                                                |
| Review and update the Information risk policy      | DS Senior   |                                                |
| team,                                              |             |                                                |
| Information                                        |             |                                                |
| Assurance                                          |             |                                                |
| and DRO                                            |             |                                                |
| Ongoing                                            | Not started | Produce guidance on IM risk, working with      |
| teams and projects that are affected by the risks. |             |                                                |
|                                                    |             |                                                |
|                                                    |             |                                                |
| DS Senior                                          |             |                                                |
| team,                                              |             |                                                |
| Information                                        |             |                                                |
| Assurance                                          |             |                                                |
| and DRO                                            |             |                                                |
| Ongoing                                            | In progress | All information systems that impact on digital |
| continuity of information must have an IM risk in  |             |                                                |
| their project risk register                        |             |                                                |
| .                                                  |             |                                                |
| DS Senior                                          |             |                                                |
| team,                                              |             |                                                |
| Information                                        |             |                                                |
| Assurance                                          |             |                                                |
| and DRO                                            |             |                                                |
| Where KIM team is engaged with projects we are     |             |                                                |
| ensuring that information management risks are     |             |                                                |
| identified and managed appropriately, for example, |             |                                                |
| O365 project.                                      |             |                                                |
|                                                    |             |                                                |
| Ongoing                                                                                                                               | Started                                           | Work with Better Information Information for    |
|---------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------|-------------------------------------------------|
| Better Government programme work on                                                                                                   |                                                   |                                                 |
| information management risk.                                                                                                          |                                                   |                                                 |
| DRO and KIM                                                                                                                           |                                                   |                                                 |
| Policy and                                                                                                                            |                                                   |                                                 |
| Engagement                                                                                                                            |                                                   |                                                 |
| DfT has played a key role in the BI4BG information                                                                                    |                                                   |                                                 |
| risk working group helping to develop an information                                                                                  |                                                   |                                                 |
| risk model and thenm feeding into the development                                                                                     |                                                   |                                                 |
| and testing of a information risk management tool.                                                                                    |                                                   |                                                 |
| Will use this to help us improve our approach to                                                                                      |                                                   |                                                 |
| managing information management risks within DfT                                                                                      |                                                   |                                                 |
| including the development of a KIM risk register                                                                                      |                                                   |                                                 |
| Ongoing                                                                                                                               | In progress                                       | KIM team to work more closely with Information  |
| Assurance team                                                                                                                        |                                                   |                                                 |
|                                                                                                                                       |                                                   |                                                 |
| KIM Team                                                                                                                              | The KIM team require BROs to submit a return each |                                                 |
| year detailing their holdings and levels of IM                                                                                        |                                                   |                                                 |
| compliance.                                                                                                                           |                                                   |                                                 |
|                                                                                                                                       |                                                   |                                                 |
| KIM now works with the Information Assurance                                                                                          |                                                   |                                                 |
| team to provide details of previously unknown                                                                                         |                                                   |                                                 |
| information assets which are uncovered as part of                                                                                     |                                                   |                                                 |
| their interactions with BROs.                                                                                                         |                                                   |                                                 |
|                                                                                                                                       |                                                   |                                                 |
| KIM has recently worked closely with the                                                                                              |                                                   |                                                 |
| Information Assurance team helping identify                                                                                           |                                                   |                                                 |
| information that would be within scope of GDPR                                                                                        |                                                   |                                                 |
| requirements.                                                                                                                         |                                                   |                                                 |
|                                                                                                                                       |                                                   |                                                 |
| March 2019                                                                                                                            | Complete                                          | KIM Team                                        |
| has taken actions from that board to work with                                                                                        |                                                   |                                                 |
| those areas which carry the greatest risk i.e. HR and                                                                                 |                                                   |                                                 |
| Procurement                                                                                                                           |                                                   |                                                 |
|                                                                                                                                       |                                                   |                                                 |
| KIM team to work closely with Data Protection                                                                                         |                                                   |                                                 |
| team in relation to the changes in requirements                                                                                       |                                                   |                                                 |
| for personal data in line with the                                                                                                    |                                                   |                                                 |
| implementation of GDPR. This will cover                                                                                               |                                                   |                                                 |
| corporate systems as well as shared drives.                                                                                           |                                                   |                                                 |
|                                                                                                                                       |                                                   |                                                 |
|                                                                                                                                       |                                                   |                                                 |
| 6                                                                                                                                     |                                                   |                                                 |
| Engage with the business and establishing more concrete and tailored principles that establish what information staff need to capture |                                                   |                                                 |
| and keep.                                                                                                                             |                                                   |                                                 |
|                                                                                                                                       |                                                   |                                                 |
 

 Reviewing information and records management policy to ensure key requirements set out in the Section 46 Code of practice are 
factored in, paying particular attention to key areas such as email chains, drafts, evidence of decision and key context. 
 Ensuring consistent coverage of information and records management as part of induction and leavers processes.  Clearly establishing required behaviours for all staff including managers and senior staff in information management policy. 
 Publishing retention schedules on GOV.UK in line with recommendations in Sir Alex Allan's Records Review. 
 
Intention was for KIM team to be able to focus its attention on policy and guidance work once IMM team was in place and up and running. However, due to personnel changes in the IMM team and a necessary change to the migration process, KIM team's time has been unexpectedly IMM heavy in the past few months. This has impacted on our ability to work on policy and guidance. Now that the TiME rollout is underway and is being led by the IMM project team, KIM team can turn its attention to updating policies and guidance around what information to keep. This is even more important given office moves, the introduction of new technology and smarter, more flexible working. Commentary last updated: April 2019 

 
 Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
End 2019  
In progress 
KIM Policy & Engagement 
New records retention policy and guidance to be developed - to cover emails, P drives, shared drives, and corporate systems. 
As DfT has moved to new IM systems this has allowed a reconsideration of how it deals with retention and disposal. New policies have been determined and now requires the documentation to support. New guidance will be developed in line with new IM systems. A paper was presented to the Digital Service Board on our approach to retention. The intention is that this will form the basis of an overarching policy on retention. 
End 2019 
In progress 
KIM Policy & Engagement 
Information and records policies to be reviewed and updated to incorporate key requirements of S46 code of practice. 
Work has started to review existing KIM guidance and identify gaps. Progress has slowed due to the demands of other projects such as IMM and staff shortage. We also need to take account of impact of 
other projects such as O365 and ensure that our messages are aligned. S46 code is being reviewed and updated. DfT are 
part of the drafting group for this work.  
Autumn 2019 
In progress 
New joiners, movers and leavers policies. New guidance and processes for both corporate and local requirements. 
Digital Service & KIM team 
We have fed into joiners and leavers policies for DS staff and are currently trying to get the managers checklist for joiners updated on my DfT. We train BROs/LIMs who then in turn provide training for new starters on good information and records management and TiME.  

## 7  Now Incorporated With Recommendation 5 (See Above) 8 Strengthen Arrangements For Information Management Governance And Oversight Of Performance In The New It Environment

 
 Appointing business champions for information management (Local Information Managers - LIM) on a business as usual basis, 
beyond the SharePoint Online roll-out period. 
 Defining the relationship between this role and the BRO role (or its successor) to allow system administration and promotion of 
required behaviours across the IT environment as a whole. In the meantime DfT should continue to support the BRO role. 
 Ensuring information management representation on IT, data and digital focussed governance boards.  Establishing requirements for a robust monitoring regime once the new IT environment is in place to map the maturity and capability 
of business areas. DfT needs to ensure good practice can be shared and poorly performing areas can be identified and targeted. 

## 

The KIM team has recently been through a restructure to ensure that it has appropriate resource to support governance and oversight of the new IT environment amongst other things. The Head of KIM is now supported by two SEO Leads one taking responsibility for KIM policy and engagement and the other KIM services and compliance. These SEOs are supported by three HEO KIM advisors. One additional EO administrator post has also been created to support both KIM and FOI teams. Since the last progress review one of our HEOs moved into 

## 

another role outside DfT. We have recruited a replacement (due to start late spring 2019). Following a review of the IMM project at the end of 2018 it was agreed that two HEO posts would be moved from the project to be recruited permanently into the KIM team and they will also start in late spring 2019. Although these posts will still focus on IMM initially it will enable us to put more resource to this work in the long term. Commentary last updated: April 2019 

 
 Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
Summer 2018 
Complete 
KIM Policy & Engagement 
Attend Digital Design Authority meetings and ensure that IM requirements are considered alongside the technical requirements 
A KIM representative now attends the DDA meetings and ensures that where the technical solutions have an impact on the management of information these 
are highlighted and considered before a decision is 
agreed on for a proposed way forward. 
 
March 2019 
In progress 
KIM Policy & Engagement 
Agree process to analyse and action destruction process for leavers email accounts and personal drives 
Before destruction can be carried out a full audit of these accounts is required to ensure DfT is meeting its obligations for the Independent Inquiry into Child Sex Abuse. The KIM team have been working with Information Assurance colleagues to determine a clear process and a draft has been produced. This is expected to be finalised during summer 2018 and work commenced soon after. However, this work could not be started due to the migration of p drives and email accounts into O365. Now that this has happened the process is in place and the first tranche of leavers accounts has been searched. The process will become BAU after a trial period. 
Summer 2018 
Complete 
KIM Policy & Engagement 
Personal (P) drives held in shared drives have had a technical control in place for 5 years. KIM has agreed 
Ensure technical controls to assist in the management of personal drives is in place and reflected in DfTs IM policy. 
 
technical controls to be in place for personal drives as they migrate into O365. 
Spring  2019 
Complete 
KIM Service 
& Compliance 
Replace Business Records Officer (BRO) role with 
the new governance role of Local Information Manager (LIM), introducing a new 
curriculum/skills framework for LIM role. 
A LIM role description has been created. LIM training 
has been developed and will be delivered to LIMs as they move to TiME.  Further training/networking opportunities will be rolled out as required. 
Complete 
Winter 2018- 19 
Review and update annual IM Healthcheck to cover O365 environment 
KIM Service & Compliance BRO and LIM survey updated and completed in late 2018. XX% completion which was really positive. Did some analysis of the survey results and produced a report. Currently considering how we use this.  
 
Ongoing 
Ongoing 
Actively monitor non-compliance with KIM policies and actively support where issues arise 
KIM Service & Compliance We are working with the Change Manager to draw out what we want to measure in terms of the move to TiME and what success looks like in terms of user behaviour. We held a workshop in April on this. The intention is to survey business areas three months after the rollout and then return six months later to do some more in depth user research. Also intend to look at what statistics we can draw from our systems but until more teams have moved to TiME this will be of limited value.   

 

## 9 Increase Oversight Of Digital Information And Develop A Process For Its Appraisal, Selection And Transfer.

 
 Ensuring a clear vision of what information needs to be in scope across the IT environment as a whole. Datasets and data analytics 
outputs should be factored in. 
 
 Establishing a plan for the information held outside the shared drives including its email legacy and for ensuring material that should 
form part of the record is captured. 
 Engaging with The National Archives and cross-government work around the sensitivity review of digital information.  Working with The National Archives to establish a plan for the routine transfer of digital records. This should include identification of 
material that would benefit from transfer before deadlines established by the Public Records Act. 

## 

The TiME rollout and migration should help us to get a better sense of what is held out in business areas. Business areas are being asked to categorise information into four types: A - material for migration, B - to be maintained within the AFP and disposed of in line with retention schedule, C- information to be disposed of, D - database that will be migrated to the cloud. Following the review of the IMM project in late 2018 and taking into account lessons learned from the project so far, KIM team will take more of a role in the categorisation of data using our knowledge and system data to make decisions about what constitutes category A data and will be migrated into the new filing structure. We have also now agreed a basic plan for category B data, which will be lifted and shifted into a separate area of TiME. Commentary last updated: April 2019 

 
 Enabling/supporting actions 
Owner 
Commentary on progress 
Completion due 
Status 
Ongoing 
In progress 
KIM Service & Compliance 
Carry out a DfT wide information audit to establish a plan for ensuring that information held outside of the corporate systems are captured. 
This is partly being taken forward as part of the plan to migrate to TiME. We determine all the areas where the tema hold records and move them into a more acceptable place as part of the work. 
2019/20 
In progress 
Appraisal report to be created identifying which digital records should be considered for selection and transfer to TNA. 
KIM Service & Compliance 
Progress on producing an appraisal report has slowed due to the demands of the IMM project. However, have started to identify likely themes and key events for this and would hope to be able to pick up on this again in 2019/20. 
| Ongoing                                                  | In progress    | Establish a new process to review digital           |
|----------------------------------------------------------|----------------|-----------------------------------------------------|
| material, to include selection and sensitivity           |                |                                                     |
| review                                                   |                |                                                     |
| KIM Service                                              |                |                                                     |
| &                                                        |                |                                                     |
| Compliance                                               |                |                                                     |
| At present we are manually reviewing early digital       |                |                                                     |
| records to ensure we remain compliant with the PRA       |                |                                                     |
| These early digital records are quite bitty and DfT      |                |                                                     |
| was still consistently producing paper records during    |                |                                                     |
| this period. We haven't identified anything worthy of    |                |                                                     |
| transfer to TNA so far.                                  |                |                                                     |
|                                                          |                |                                                     |
| We are aware that we need to develop a proper            |                |                                                     |
| process for digital review going forward and this is a   |                |                                                     |
| key part of our KIM business objectives for 2019/20      |                |                                                     |
| and beyond. This may require more business area          |                |                                                     |
| involvement and in some areas of the department          |                |                                                     |
| this may be resource intensive. A paper would need       |                |                                                     |
| to be submitted to ExCo getting agreement for the        |                |                                                     |
| proposed way forward.                                    |                |                                                     |
|                                                          |                |                                                     |
|                                                          |                |                                                     |
|                                                          |                |                                                     |
| To be delayed                                            | Not started    | Take steps to begin a first digital transfer to TNA |
| digital transfer process with. So far our digital review |                |                                                     |
| work has not yet unearthed a collection of records       |                |                                                     |
| that we could pilot digital transfer with.               |                |                                                     |
|                                                          |                |                                                     |