## 1 Hm Treasury (Hmt) Should Further Develop Its Approach To Information Asset Management To Gain Greater Control Of Its Information Assets.

 Defining what an information asset is for HMT.  Considering how it can best document its information assets, drawing on the work that the Knowledge and Information 
Management (KIM) team is doing to survey and document the digital information that the department holds. 
 Developing a method of reporting on assurance of these assets and linking this with the benchmarking process already 
established for Knowledge Management (KM). 
 Defining the Information Asset Owner (IAO) role and considering how this can be better supported through training, guidance and 
networks. 

Actions to address recommendations 
and reduce risk  
Owner 
Due for completion 
Priority: High / Medium / Low 
Not applicable 
Departmental Records Officer 
1A Review, redraft and communicate policy and associated documentation on information risk and assest management. Include a clear definition of what an asset is. 
Not applicable 
Departmental Records Officer 
1B Complete an Information Asset Register and institute a process for maintaining it. 
Not applicable 
Departmental Records Officer 
1C Incorporate measures for asset assurance reporting into the new revision of KM Benchmarking. 1D Allocate a specific resource and develop a support offer for the IAO role. 
Not applicable 
Departmental Records Officer 
 
 
Status 
Additional commentary 
January 2017 
UNDERWAY 
- Revision of RM and security policies undertaken - Comprehensive policy consolidation exercise underway 
March 2017 
UNDERWAY 
- First draft of register completed - Resource recruited - Process to be defined and delivered 
January 2017 
UNDERWAY 
- Revision of RM and security policies undertaken - Review of KM Benchmarking underway 
October 2016 
UNDERWAY 
- Resource recruited - Offer to be defined 

## 2 Hmt Should Build On The Work It Has Done So Far And Continue To Develop Its Approach To The Management Of Both Its Current And Legacy Digital Information.

 Ensuring that the Information Management Project stays on track and continues to have the support and investment that its 
needs. 
 Addressing issues around structure, access permissions and disposal as part of the Information Management Project.  Gaining a greater sense of staff practice on the shared and personal drives and email through monitoring and increased reporting, 
possibly as part of the KM Benchmarking. 
 Decommissioning any shared drives that aren't necessary to ensure maximum take up of Info Store.  Making sure IT is involved when business areas want to use collaboration and other web tools. Including rules about the use of 
these systems and capture of record content in the Records Management Policy and related guidance and effectively 
communicating this to staff.  
 Raising staff awareness of how to optimise search within Info Store through guidance and the KM Champions and Site Owners.  Reviewing the Site Owner role to evaluate whether the right people are carrying out the function and considering how many Site 
Owners are needed. Ensuring that the role is reflected in their performance objectives, as it is for the Knowledge Champions. 
 Continuing to embed the use of Info Store across the organisation through communications, training, guidance and the KM 
Champions and Site Owners.   
 Further consideration of what digital information it can proactively release and engaging with end users to see what would be of 
value. 
 Where additional tools are used by business areas, ensuring that IT is involved in this process and that rules about the use of 
these systems and capture of record content are included within the Records Management Policy and related guidance and that this is communicated to staff. 

| Status                                    | Additional commentary    | Actions to address recommendations    |
|-------------------------------------------|--------------------------|---------------------------------------|
| and reduce risk                           |                          |                                       |
|                                           |                          |                                       |
| Owner                                     | Due for                  |                                       |
| completion                                |                          |                                       |
| Priority: High                            |                          |                                       |
| / Medium /                                |                          |                                       |
| Low                                       |                          |                                       |
| 2A Complete the IM project as             |                          |                                       |
| scheduled. Implement the Records          |                          |                                       |
| Centre (archiving) service as part of the |                          |                                       |
| Not applicable                            | Departmental             |                                       |
| Records                                   |                          |                                       |
| Officer                                   |                          |                                       |
|                                           |                          |                                       |
| October 2016                              | COMPLETE                 | - Project on schedule                 |
| - Requirements delivered for archiving    |                          |                                       |
| service                                   |                          |                                       |
Info Store solution. 2B Close down existing file shares as part of the IM project. 
Not applicable 
Departmental Records Officer 
Not applicable 
Departmental Records Officer 
2C Implement a reporting service, to track records storage and quality, as part of the Info Store solution. 2D Implement an extranet facility for safe external collaboration. 
Not applicable 
Departmental Records Officer 
Not applicable 
Departmental Records Officer 
2E Design a communications and change strategy as part of the IM project, to include training and guidance on the 
Info Store application. 
Not applicable 
Departmental Records Officer 
2F establish a new (smaller) cohort of Site Owners, introduce new mandatory training and continue to sustain the Site Owner community. 
Not applicable 
Departmental Records Officer 
2G Review, redraft and communicate policy and associated documentation on records management as part of the IM project. 
 
December 2016 
UNDERWAY 
- Shared drive users identified - Content migrated - Plan to reset permissions in place 
 
December 2016 
UNDERWAY 
- Requirements in place - Build underway 
November 2016 
UNDERWAY 
- Build complete - Pilot being planned 
October 2016 
COMPLETE 
- Strategy defined and being delivered 
October 2016 
COMPLETE 
- Smaller group defined - Training delivered - Resource in place to support Site Owners 
October 2016 
COMPLETE 
- Addressed in the Comms and Change Strategy 

## 3 Hmt Needs To Improve Its Approach To Managing Information Risk Within The Wider Hmt Risk Management Framework.

 Putting together a description of information risk that reflects that information risk is not just about physical loss of information or 
cyber-attacks but is also about the ongoing availability and integrity of information and communicating this to staff. 
 Ensuring that senior management and IAOs understand the importance of identifying and managing information risk and of the 
negative impact if information is not managed and protected appropriately through briefings and training. 

Actions to address recommendations 
and reduce risk  
Owner 
Due for completion 
Priority: High / Medium / Low 
Not applicable 
Departmental Records Officer 
3A Review, redraft and communicate policy and associated documentation on information risk and assest management. 
Include a clear definition of what information risk is. 
Not applicable 
Departmental Records Officer 
3B Actively communicate information risk to SCS. This includes sessions for EMB, Treasury Sub-Committee and the weekly SCS comms meeting. 
Not applicable 
Departmental Records Officer 
3C Establish routine reporting to the SIRO and to the Organisational Risk Group. 
|                                         | Status    | Additional commentary                  |
|-----------------------------------------|-----------|----------------------------------------|
| January 2017                            | UNDERWAY  | - Revision of RM and security policies |
| undertaken                              |           |                                        |
| - Comprehensive policy consolidation    |           |                                        |
| exercise underway                       |           |                                        |
| - Launch next year                      |           |                                        |
| October 2016                            | COMPLETE  | - EMB visited three times since the    |
| audit. Includes review of risk appetite |           |                                        |
| and visit by TNA to the Board Sub-      |           |                                        |
| Committee                               |           |                                        |
| - SCS Comms visited three times,        |           |                                        |
| including by TNA                        |           |                                        |
| - Group meetings visited                |           |                                        |
| October 2016                            | COMPLETE  | - Periodic sessions with SIRO          |
| scheduled (quarterly)                   |           |                                        |
| - Monthly reports to ORG                |           |                                        |

## 4 Hmt Should Continue To Invest Time And Effort In Supporting And Further Developing The Km Benchmarking.

 Thinking about how the process will be developed to challenge and motivate high- scoring business areas to continue to drive 
improvement. 
 Exploring whether the process can be used to gather more detailed evidence of information and records management practice in 
business areas, for example, around use of Info Store, shared and personal drives, filing of emails etc. 
 Considering whether information assurance reporting can be linked or incorporated into this process. 

Actions to address recommendations 
and reduce risk  
Owner 
Due for completion 
Priority: High / Medium / Low 
Not applicable 
Departmental Records Officer 
4A Substantially revise KM Benchmarking for a fresh approach in Q4 (2016/17). 
 
Not applicable 
Departmental Records Officer 
4B Incorporate the new Info Store reporting service into the revision of KM Benchmarking. 
Not applicable 
Departmental Records Officer 
4C Incorporate measures for asset assurance reporting into the revision of KM Benchmarking. 
|                                  | Status    | Additional commentary                  |
|----------------------------------|-----------|----------------------------------------|
| January 2017                     | UNDERWAY  | - Extensive research and consultancy   |
| on alternative models            |           |                                        |
| - Proposal to Leadership Team in |           |                                        |
| December                         |           |                                        |
| December                         |           |                                        |
| 2016                             |           |                                        |
| UNDERWAY                         |           |                                        |
|                                  |           |                                        |
| - Requirements in place          |           |                                        |
| - Build underway                 |           |                                        |
| January 2017                     | UNDERWAY  | - Revision of RM and security policies |
| undertaken                       |           |                                        |
| - Review of KM Benchmarking      |           |                                        |
| underway                         |           |                                        |

## 5 Hmt Should Continue To Build On The Positive Work It Has Done So Far In Developing An Approach For The Appraisal, Selection, Sensitivity Review And Transfer Of Digital Information.

 Building up a full picture of its digital holdings. 
 Applying disposal criteria to legacy and current digital records.  Developing a method of appraising digital records including the use of Series Level Appraisal Questionnaires (SLAQ).  Devising an approach to sensitivity reviewing its digital information.  Deciding how it will transfer digital information and testing this.  Continuing to engage with The National Archives Information Management Consultant (IMC) and Digital Transfer User Group.  Sharing knowledge, experience and learning from other government departments; testing and piloting different approaches.  Publishing guidance on what to keep and/or retention or disposal schedules on GOV.UK. 

Actions to address recommendations 
and reduce risk  
Owner 
Due for completion 
Priority: High / Medium / Low 
Not applicable 
Departmental Records Officer 
5A Consolidate our records on the Info Store platform through completing the IM project and closing down shared drives. 
Not applicable 
Departmental Records Officer 
5B Enable records disposition on the Info Store application by implementing a Records Centre service. 
Not applicable 
Departmental Records Officer 
5C Ensure that digital Series Level Appraisal Questionnaires (SLAQs) are approved completed for the entirety of the Panagon collection (1996-2004). 
Not applicable 
Departmental Records Officer 
5D Plan to revist sensitivity review of the Panagon collection at least three years before scheduled transfer (currently planned as 2022) to allow one year to 
 
Status 
Additional commentary 
December 2016 
UNDERWAY 
- Shared drive users identified - Content migrated - Plan to reset permissions in place 
October 2016 
COMPLETE 
- Requirements delivered for archiving service 
Octrober 2016 
COMPLETE 
- SLAQs completed 
October 2016 
COMPLETE 
- SLAQs completed - Long term transfer plan in place 
pilot and procure a solution and two years to complete the review task. 5E Publish the HM Treasury Retention 
and Deletion Policy on GOV.UK. 
Not applicable 
Departmental 
Records Officer 
Not applicable 
Departmental Records Officer 
5F Attend National Archives meetings, share expertise across government and 
participate in Cabinet Office's digital 
records project 
| January 2017                           | UNDERWAY    | - Comprehensive policy consolidation    |
|----------------------------------------|-------------|-----------------------------------------|
| exercise underway                      |             |                                         |
|                                        |             |                                         |
| October 2016                           | COMPLETE    | - Meetings attended                     |
| - Presentations given                  |             |                                         |
| - Project initiation document in place |             |                                         |
| for work with Cabinet Office           |             |                                         |
|                                        |             |                                         |

## 6 Hmt Should Continue Making Positive Steps In The Management Of Its Paper Records, Including Appraisal, Selection And Transfer.

 Ensuring that it keeps on track with its transfer plan as agreed by the Advisory Council (AC).  Carrying on work with Government Remote Services (GRS) on requisitioned records. 
 Continuing its good work in managing the relationship with outside contractor/s carrying out management of paper records and 
accelerated review. 

Actions to address recommendations 
and reduce risk  
Owner 
Due for completion 
Priority: High / Medium / Low 
Not applicable 
Departmental Records Officer 
6A Revisit the ACNRA, report on progress and refresh our Retention Instrument (RI). 
Not applicable 
Departmental Records Officer 
6B Declare all records that are misplaced in Department and ensure that the TNA catalogue is updated. 
Not applicable 
Departmental Records Officer 
6C List all retained items and extended closures. Return all non-sensitive files to the National Archives and plan to refer and process all sensitive files in the next three years. 6D Review supplier delivery monthly and hold a full contract review annually. 
Not applicable 
Departmental Records Officer 
|                                   | Status                               | Additional commentary            |
|-----------------------------------|--------------------------------------|----------------------------------|
| October 2016                      | COMPLETE                             | - ACNRA revisted and RI in place |
| December                          |                                      |                                  |
| 2016                              |                                      |                                  |
| UNDERWAY                          | - Work underway, final figures to be |                                  |
| confirmed                         |                                      |                                  |
| January 2017                      | UNDERWAY                             | - List completed and reviewed    |
| - Return of non-sensitive items   |                                      |                                  |
| underway                          |                                      |                                  |
| - Planning for sensitive underway |                                      |                                  |
| October 2016                      | COMPLETE                             | - Monthly meetings in place      |
| - Annual review in place          |                                      |                                  |