Department of Energy and Climate Change (DECC) Information Management Assessment Programme Action Plan 
 
# 
Recommendation 
Actions 
Priority High/ Low/ Medium 
Med 
January 2013 
Action 1.1: Digital continuity risks to be formally introduced 
into SLA requirements.  
R1 
DECC must ensure that where key services are procured under SLAs that knowledge and information continuity risks are monitored and 
reported periodically to the Shared 
Services Integration Project Board.  . This may be achieved by; 
 
Defining a set of metrics for contract monitoring 
 
Agreeing a timetable for reporting 
 
 
High 
Complete 
Head of KIM 
R2 
DECC to develop an implementation plan, including timeline and benefits realisation, for the Knowledge- Sharing Strategy. This may be achieved by; 
 
A detailed project plan with agreed milestones 
 
Regular updates to a relevant change programme or project board. 


High 
Complete 
Head of KIM 
R3 
The KIM team should modify and review the EDRMS metrics so that they continue to challenge and raise EDRMS use. This may be achieved by; 
 
Including, number of documents into the EDRMS, when updated, number of emails filed etc 
 
R4 
KIM team to review how the profile 
Action 4.1:  restate the 
Med 
Complete 
Head of 
4.1 In May 2012 the Chief 
Yes 
 
Signed: _________________________  
Timescale 
Owner 
Observations 
Delivered? Yes/No 
No 
Head of KM 
Consultation with the KIM team on such risks  is now normal practice.  The DECC Development Programme (addressing the recommendation of the recent Capability Review) will ensure that this is formally embedded into the processes for 
developing SLA requirements   
Yes 
An implementation plan was agreed in September 2011 and is due for review in October 2012.  Progress is reported quarterly to The KIM Steering Group, and progress against major milestones is reported monthly to the Chief operating Officer.   
Yes 
DECC's Operational Business Plan contains a KPI for EDRMS use -  80% of staff to be an active user by March 2013.  The number of records which must be saved to qualify as an active user has been increased from 1 to 
4 per month. 
assessed once this has which they deliver for their 
a new intranet. Initially this will not support communities of practice, but it is intended to introduce this functionality in the future. known collectively as the IM have a standing agenda item to identify new training needs, prioritising most common areas of concern for end users. have developed training 
courses on search and 
remote working which they 
deliver to their teams. 
| High                                   | Nov 2012                     | Head of    |
|----------------------------------------|------------------------------|------------|
| KIM                                    |                              |            |
| Action 8.1: DECC staff                 |                              |            |
| to attend Digital                      |                              |            |
| Continuity training at                 |                              |            |
| TNA                                    |                              |            |
| Action 8.2: Information                |                              |            |
| Asset Register to  be                  |                              |            |
| reviewed and updated                   |                              |            |
| R8                                     |                              |            |
| DECC should use the Digital            |                              |            |
| Continuity Guidance produced by        |                              |            |
| The National Archives to expand its    |                              |            |
| Information Asset Register to create   |                              |            |
| a management tool to support the       |                              |            |
| management of information over         |                              |            |
| time and through change. This may      |                              |            |
| be achieved by;                       |                              |            |
| High                                   | Dec 2012                     | Departmen  |
| tal Security                           |                              |            |
| Officer/Hea                            |                              |            |
| d of KIM                               |                              |            |
|                                        |                              |            |
| Reference the Digital Continuity       |                              |            |
| guidance  to support on the            |                              |            |
| National Archives Website              |                              |            |
| 1                                      |                              |            |
|                                        |                              |            |
| Action 9.1: IAO training               |                              |            |
| and awareness                          |                              |            |
| High                                   | Complete                     | Departmen  |
| tal Security                           |                              |            |
| Officer                                |                              |            |
| R9                                     |                              |            |
| DECC should put in place a             |                              |            |
| programme to train the IAOs and        |                              |            |
| raise awareness of the role and its    |                              |            |
| responsibilities. This may be          |                              |            |
| achieved by;                          |                              |            |
|                                        | Using the Digital Continuity |            |
| guidance as a basis for the            |                              |            |
| training                              |                              |            |
| High                                   | March 2013                   | Departmen  |
| tal Security                           |                              |            |
| Officer/Hea                            |                              |            |
| d of KIM                               |                              |            |
| Action 9.2 Amend IAO                   |                              |            |
| training to include                    |                              |            |
| digital continuity,                    |                              |            |
| Transparency  and                      |                              |            |
| changes to GPMS                        |                              |            |
|                                        |                              |            |
| Reviewing how the IAO role has         |                              |            |
| been assigned within DECC              |                              |            |
|                                        |                              |            |
|                                        | High                         | Complete   |
| tal Security                           |                              |            |
| Officer                                |                              |            |
| R10                                    |                              |            |
| Information related to business        |                              |            |
| critical assets within the IAR must be |                              |            |
| tied into departmental business        |                              |            |
| continuity planning. This may be       |                              |            |
| achieved by;                          |                              |            |
|                                        | Reference to the Digital     |            |
| Continuity guidance                    |                              |            |
|                                        |                              |            |
| Med                                    | Dec 2012                     | Head of    |
| KIM                                    |                              |            |
| R11                                    |                              |            |
| DECC should use The National           |                              |            |
| Archives' guidance to develop a        |                              |            |
| What to Keep schedule for the          |                              |            |
| department. This may be achieved       |                              |            |
| by;                                   |                              |            |

                                            
1 http://www.nationalarchives.gov.uk/documents/information-management/customer-guide-to-framework.pdf 

|                               | No                         |
|-------------------------------|----------------------------|
| No                            | This will include an       |
| assessment of digital         |                            |
| continuity needs, and will    |                            |
| identify any additional data  |                            |
| which DECC can publish to     |                            |
| support Transparency and re-  |                            |
| use.                          |                            |
| Yes                           | DECC reviewed and updated  |
| training in 2011 which has    |                            |
| now been delivered to all     |                            |
| IAOs.                         |                            |
|                               | No                         |
| Yes                           | DECC completed a review of |
| its Business Continuity Plan  |                            |
| and processes in 2011,        |                            |
| including business critical   |                            |
| information assets.  This has |                            |
| now been implemented          |                            |
| across the Department.        |                            |
| No                            |                            |
Action 12.1: Review of use of personal and shared drives DECC  
R12 
DECC to conduct a review of information held on personal drives and consider introducing a size limit. This may be achieved by; 
 
 
By linking the information from the IAR, information on ICT systems. 
 
Use the knowledge of the in house IT staff, contractors, IMs, IARs and managers to collate this information 
 
R13 
DECC should ensure that IMs are empowered to challenge staff over poor naming of documents and encourage colleagues to follow departmental guidance. This may be achieved by; 
Action 13.1: Chief Operating Officer to email to DGs and Directors 
 
Refer to recommendation 4 above 
 
 
R14 
DECC needs to increase usage of the EDRMS and enforce limits on exceptions to the policy and communicate to all. This would be supported by: 
 
Limiting personal drive sizes 
 
Reviewing the provision of shared drives to business units 

 
Using IMs and middle managers 
to drive compliance 


_________________________ 

incorporate new guidance and processes on What to 
Keep. We will liaise with The National Archives to keep them up to date on progress. We are undertaking a review of the use of these drives to better understand their content and the reasons behind their use. We anticipate that this, supported by revised EDRMS metrics and communications plan, and the new EDRMS/SharePoint interface mentioned above, will significantly reduce the 
amount of information held in repositories other than the EDRMS. In May 2012 the Chief Operating Officer reiterated the importance of the IM role to all DGs and Directors (the message also mandated EDRMS use for all corporate records, and that it is the responsibility of managers to ensure this happens). EDRMS use for corporate records is mandated by the Permanent secretary, and any exceptions must be approved by the KIM team. See recommendations 3 and 12 above for other initiatives to increase EDRMS use. 
 
| Med                                    | Dec 2012                    | Head of    |
|----------------------------------------|-----------------------------|------------|
| KIM                                    |                             |            |
| R15                                    |                             |            |
| The KIM team to develop appraisal      |                             |            |
| criteria for legacy records. This may  |                             |            |
| be achieved by;                       |                             |            |
| Action 15.1: Develop                   |                             |            |
| appraisal criteria for                 |                             |            |
| legacy records                         |                             |            |
|                                        |                             |            |
|                                        | See recommendation 11 above |            |
|                                        |                             |            |
| Med                                    | Dec 2012                    | Head of    |
| KIM                                    |                             |            |
| R16                                    |                             |            |
| The KIM team need to ensure that       |                             |            |
| KIM guidance references all record     |                             |            |
| types, including legacy paper          |                             |            |
| records. This may be achieved by;     |                             |            |
| Action 16.1: Update                    |                             |            |
| KIM guidance to                        |                             |            |
| include reference to                   |                             |            |
| legacy paper records                   |                             |            |
|                                        | Update current records and  |            |
| information guidance.                  |                             |            |
|                                        |                             |            |
| Action 17.1: Undertake                 |                             |            |
| audit                                  |                             |            |
| Med                                    | Nov 2012                    | Head of    |
| KIM                                    |                             |            |
| Action 17.2: Report                    |                             |            |
| and recommendations                    |                             |            |
|                                        | Dec 2012                    | Head of    |
| KIM                                    |                             |            |
| Action 17.3: Implement                 |                             |            |
| recommendations                        |                             |            |
|                                        | Jan 2013                    | Head of    |
| KIM                                    |                             |            |
| R17                                    |                             |            |
| The KIM team to liaise with the        |                             |            |
| Private Offices in the implementation  |                             |            |
| of an annual audit as referenced       |                             |            |
| within The National Archives'          |                             |            |
| guidance to ensure that they are       |                             |            |
| operating effectively. This may be     |                             |            |
| achieved by;                          |                             |            |
|                                        |                             |            |
| Reference to Guidance on the           |                             |            |
| Management of Private Office           |                             |            |
| Papers                                 |                             |            |
| 2                                      |                             |            |
|                                        |                             |            |
|                                        |                             |            |
| N/A                                    |                             |            |
| not allow access to                    |                             |            |
| individual's email accounts            |                             |            |
| R18                                    |                             |            |
| The KIM Team and ICT should audit      |                             |            |
| email inboxes to provide the base to   |                             |            |
| identify and mitigate the risk of poor |                             |            |

## 

_________________________  
_________________________ 

| No                              | DECC is working with BIS, its    |
|---------------------------------|----------------------------------|
| shared service provider, to     |                                  |
| review all records over 8       |                                  |
| years old by the end of 2012.   |                                  |
| This will provide appraisal     |                                  |
| criteria, which can be applied  |                                  |
| to newer records covering the   |                                  |
| same the functions, as well     |                                  |
| as those included in the        |                                  |
| current exercise.               |                                  |
|                                 |                                  |
| The appraisal methodology       |                                  |
| has been approved by TNA        |                                  |
| and records for permanent       |                                  |
| preservation have already       |                                  |
| been identified for transfer to |                                  |
| Kew.                            |                                  |
|                                 |                                  |
|                                 | No                               |
|                                 | No                               |
|                                 | No                               |
|                                 | No                               |
| No                              |                                  |
managing digital continuity drawing on expertise from all relevant teams within the department. This may be 
roadmap for MATRIX, continuing to 
engage suppliers and pilot new 
approaches to identify options. This 

 
Signed: _________________________  
_________________________  
_________________________ 
 
 
Department 

apart unless there are exceptional circumstances. DECC recognises that emails form a significant part of the corporate record and we already address this by deleting all emails after 12 months, ensuring that emails which are of ongoing value must be saved into the EDRMS.  There is a limit on the size of inboxes, and staff cannot save older emails as .pst files.  Capturing emails as part of the corporate record is supported by the programme to increase use of 
the EDRMS, and storage  of emails will be included in new DECC-wide information management policy and plan mentioned above. strategy, in line with the review of its Information Asset Register by December 2012.  Digital continuity will also be added to IAO training when new IT requirement are being developed.  The DECC Development programme will ensue that this is formally embedded into the processes for developing requirements   
DECC by BIS as part of 
shared service.  An upgrade 
is planned in March 2013 
may be achieved by; 
 
See Recommendation 8 above 
 
Med 
Scheduled to start from April 2013 
Action 21.2: Programme to integrate EDRMS with SharePoint 2010 
Med 
January 2013 
Head of KIM/Head of IT 
Action 22.1: Embed digital continuity into procurement of new systems  
R22 
DECC to include digital continuity requirements in the specification and procurement of new systems to cover interoperability, data exchange and extraction and standardised technology. This may be achieved by; 
 
See Recommendation 8 above 
 
Action 23.1: review completion of online data handling training 
High 
Complete 
Departmen tal Security Officer 
R23 
DECC to review how data protection training is cascaded and implemented to ensure personal information is held and managed effectively. This may be achieved by; 
 
Reviewing the attendance of the courses 
 

_________________________ 

which will allow DECC to integrate the EDRMS with 
SharePoint 2010. 
DECC's current IT contract 
ends in March 2014. Planning for the provision of a new service is well advanced, and includes EDRMS provision.  As part of this exercise DECC has assumed continuation of the EDRMS service provided by BIS. However, we are also assessing other options (for example services available in the G-Cloud) to confirm that the shared service continues 
to provide the best overall EDRMS solution for DECC. 
No 
Head of KIM 
No 
This is interlinked with the action for recommendation 20 above. Consultation with the KIM team is now normal practice when new IT requirement are being developed.  The DECC Development programme will ensue that this is formally embedded into the processes for developing requirements   
Yes 
86% of DECC staff completed the mandatory level 1 training in 2011. A target of 90% has been set for 2012 and is championed 
by the SIRO. 
 
Managing personal and 
| High                                | Complete                    | Head of    |
|-------------------------------------|-----------------------------|------------|
| KIM                                 |                             |            |
| Action 24.1: Review                 |                             |            |
| FOI training content                |                             |            |
| with BIS                            |                             |            |
| R24                                 |                             |            |
| DECC should work within the BIS     |                             |            |
| SLA to refresh the FoI training and |                             |            |
| develop an communication            |                             |            |
| programme for staff.                |                             |            |
|                                     |                             |            |
| High                                | Complete                    | Head of    |
| KIM                                 |                             |            |
| Action 24.2:                        |                             |            |
| Communication                       |                             |            |
| programme on FOI                    |                             |            |
| Med                                 | Oct 2012                    | Head of    |
| KIM                                 |                             |            |
| Action 24.3: Provide                |                             |            |
| specialist FOI/EIR                  |                             |            |
| training from DECC                  |                             |            |
| staff as part of L&D                |                             |            |
| package                             |                             |            |
| R25                                 |                             |            |
| KIM team to develop access control  |                             |            |
| auditing processes                  |                             |            |
| Med                                 | Dec 2012                    | Head of    |
| KIM                                 |                             |            |
| Action 25.1: Develop                |                             |            |
| access control auditing             |                             |            |
| process                             |                             |            |
| High                                | Complete                    | Head of    |
| KIM                                 |                             |            |
| Action 26.1: Mandate                |                             |            |
| use of EDRMS for                    |                             |            |
| corporate records                   |                             |            |
|                                     |                             |            |
| R26                                 |                             |            |
| The KIM team to mandate the         |                             |            |
| minimum record standards to be      |                             |            |
| kept and incorporate them into WTK  |                             |            |
| and KIM guidance. This may be       |                             |            |
| achieved by;                       |                             |            |
|                                     | See recommendation 11 above |            |
|                                     |                             |            |
| Med                                 | Dec 2012                    | Head of    |
| KIM                                 |                             |            |
| Action 26.2: Review                 |                             |            |
| current guidance on                 |                             |            |
| what records to store               |                             |            |
| in EDRMS                            |                             |            |
| Med                                 | April 2013                  |            |
| onwards                             |                             |            |
| Action 26.3: Produce                |                             |            |
| What to Keep                        |                             |            |
| guidance                            |                             |            |
| R27                                 |                             |            |
| DECC should explore what            | Action 27.1: Raise          | High       |

_________________________  
_________________________ 

sensitive information is included in induction training 
for all new members of staff. 
Yes 
BIS provide tailored,  high level briefings for teams in DECC as requested.   
Yes 
There have been three FOI communication exercises since the completion of the IMA 
No 
More detailed training in both FOI and EIRs will be available as part of DECCs Learning and Development Programme from October 2012. 
No 
These will be produced jointly with the Security team 
Yes 
Use of the EDRMS for corporate records is mandated by the permanent Secretary, and in part enforced by compliance with Cabinet Office guidance on the management of Private Office records, as all submission to ministers and the permanent secretary must be submitted as EDRMS links. . 
No No 
Head of KIM 
DECC will introduce new guidance on what to keep as part of the larger programme to integrate the EDRMS and SharePoint 2010, scheduled 
to start in 2013. 
initiatives are available or in use by government departments to raise 
awareness and use of GPMS. 
awareness of new GPMS to be 
introduced in April 2013. Action 28.1: new DECC intranet 
Med 
Complete 
Head of KIM 
R28 
DECC should review, delete and rebrand BIS or Defra Intranet content. This may be achieved by; Can be incorporated into the ongoing refresh of record and information management guidance, and the review of ongoing review of EDRMS training. 
Action 29.1: Review induction training 
Med 
Complete 
Head of KIM 
R29 
DECC should assess how induction training  can be improved within available resources to meet departmental needs. 
Action 30.1: Review 
Matrix training 
Med 
April 2013 
Head of 
KIM 
R30 
The KIM team to input into the BIS 
Matrix training as part of the SLA review. This may be achieved by; 
 
Agree content to cover DECC WTK guidance and records and information management 
High 
Complete 
Head of KIM 
Action 31.1: Develop and publicise knowledge transfer processes 
R31 
DECC should develop and implement a formal knowledge capture process to include access to that information once recorded. This may be achieved by; 
 
Creating a template that includes set questions 
 
Ensure that staff and managers know when and who must complete it. 
 
tal Security Officer 
raising staff awareness  of changes to the GPMS 
scheduled for 2013. A new intranet is now in place 
Yes Yes 
KIM induction trading has been reviewed and is now presented jointly with security team to cover IA issues. 
No 
Matrix training will be 
reviewed following the planned upgrade of the EDRMS. 
Yes 
DECC now has guidance on knowledge transfer (including a template and set questions), Peer Assists, After Action Reviews and Lunch and Learn sessions on its intranet.  These  will be supported by a series of KIM awareness sessions across the Department.  Lessons learned is also being built into 
DECC's PPM processes as 
part of the DECC Development Programme.