## Hmrc - I**Nformation Management Action Plan**

| Recommendation                         | Actions                                                          |
|----------------------------------------|------------------------------------------------------------------|
| 1. HMRC should continue to invest in   | 1.1 Re-affirmation of the Chief Executive's commitment to        |
| the structures that have allowed for   | Information Management.  Director Generals to provide            |
| significant progress on information    | progress reports.                                                |
| assurance, and more recently           | 1.2 Maintain Information Champion and Data Guardian roles,       |
| management of information,             | ensure Lines of Business agree the action plan.                  |
| particularly during this period of     |                                                                  |
| efficiency savings.                    |                                                                  |
| 2. HMRC should ensure that checking    | 2.1 Provide regular progress report on assurance activity to     |
| of compliance with KIM policies and    | Director Generals/ExCOM                                          |
| standards is included as part of       | 2.2 Optimise use of Internal Audit Programme                     |
| regular internal assurance processes   |                                                                  |
| 3. HMRC should develop a KIM           | 3.1 Develop KIM metrics for use across HMRC and within Lines     |
| performance measurement regime         | of Business                                                      |
| reporting to the SIRO.                 | 3.2 Consult with Knowledge Council and others on best practice   |
|                                        | 3.2 Monitor and report progress to SIRO against this action plan |
| and KIM metrics.                       |                                                                  |
| 4. HMRC should better define the       | 4.1 Formalise the roles and responsibilities as part of work on  |
| various KIM roles within the business, | organisational design.                                           |
| provide adequate support for those     | 4.2 Publicise and communicate KIM roles, building networks       |
| roles and improve communication of     | and provide support.                                             |
| these roles to the staff.              |                                                                  |
| 5. Building on progress made, HMRC     | 5.1 Define 'what good looks like' and communicate across         |
| should take advantage of the           | HMRC.                                                            |
| Information Assurance programme,       | 5.2 Map the KIM agenda across to other Information               |
| and now expand the agenda to           | Management initiatives.                                          |
| include the benefits of good           |                                                                  |
| information management.                |                                                                  |
| 6. HMRC needs to encourage staff to    | 6.1 Work with Data Guardians to ensure data continues to be      |
| explore how they can maximise data     | shared while maintaining high security standards.                |
| flows to support delivery of its       |                                                                  |
| objectives while maintaining high      |                                                                  |
| 6 months                               |                                                                  |
| Between 6 months                       |                                                                  |
| and 3 years                            |                                                                  |
| 12 months to 2                         |                                                                  |
| years                                  |                                                                  |
| 12 months                              |                                                                  |
| Between 12                             |                                                                  |
| months and 3                           |                                                                  |
| years                                  |                                                                  |
| 3 years                                |                                                                  |
| Recommendation                                   | Actions                                                         |
|--------------------------------------------------|-----------------------------------------------------------------|
| levels of data security.                         |                                                                 |
| 7. Whilst The National Archives                  | 7.1 Consult on how the Information/Data flow mapping work in    |
| acknowledges the challenge in this               | the Departmental Security Programme will continue in the future |
| complex information environment,                 | including the role of process owners.                           |
| HMRC should continue working to                  |                                                                 |
| define key processes and their related           |                                                                 |
| information/data flows where relevant.           |                                                                 |
| 8. HMRC should continue to improve               | 8.1 Continue the work to identify and catalogue all information |
| its understanding of its key                     | assets.                                                         |
| information assets                               |                                                                 |
| 9. HMRC should harness the good                  | 9.1 Develop and deliver a communications plan to improve        |
| work that has been initiated by local            | visibility of lessons learned.                                  |
| data integrity projects, sharing                 | 9.3 Link to actions against recommendations 23 & 39             |
| lessons learned across the                       |                                                                 |
| organisation.                                    |                                                                 |
| 10. HMRC should work closely with                | 10.1 Review the 'What to Keep' guidance and approach as         |
| The National Archives and adopt the              | advocated by TNA.                                               |
| 'What to Keep' guidance approach.                | 10.2 Benchmark TNA guidance against HMRC policies and           |
| amend as appropriate.                            |                                                                 |
| 10.3 Communicate any updated guidance/standards. |                                                                 |
| 11. HMRC must introduce and                      | 11.1 Identify short/medium and longer term activities to enable |
| implement appropriate retention                  | more routine secure disposal of business records.               |
| schedules for head of duty systems.              |                                                                 |
| 12. HMRC needs to ensure that the                | 12.1 Continue ongoing work to further develop the Information   |
| owners of significant information                | Asset Owner role and communicate appropriately.                 |
| assets are urgently identified at below          |                                                                 |
| Executive Committee level, agreed                |                                                                 |
| and assigned and that this is                    |                                                                 |
| communicated appropriately.                      |                                                                 |
| 13. HMRC should ensure business                  | 13.1 Data Guardians to include CAF migration within their       |
| areas rationalise and delete files on            | assurance activity.                                             |
| migration into CAFs, sharing good                | 13.2 Lines of Business to ensure files are weeded before        |
| local practices to facilitate the                | migration into CAFs.                                            |
| progress.                                        | 13.3 Promulgate best practice - Link to activities against      |
| Between 6 and 12                                 |                                                                 |
| months                                           |                                                                 |
| Between 6 months                                 |                                                                 |
| and 3 years                                      |                                                                 |
| 12 months                                        |                                                                 |
| 12 months                                        |                                                                 |
| Within 12 months                                 |                                                                 |
| - 5 years                                        |                                                                 |
| 12 months                                        |                                                                 |
| 12 months                                        |                                                                 | | Recommendation                          | Actions                                                        |
|-----------------------------------------|----------------------------------------------------------------|
| Recommendations 38                      |                                                                |
| 14. HMRC to ensure that appropriate     | 14.1 Develop and communicate the role for CAF Information      |
| people with relevant skills are         | Managers.                                                      |
| selected to fulfil the CAF Information  | 14.2 Identify any training needs for the role.                 |
| Manager roles.                          | 14.3 Reallocate the role where approriate                      |
| 15. HMRC should conduct                 | 15.1 Develop a checklist/standard for CAF creation and         |
| compliance checks to ensure the         | management.                                                    |
| integrity of the CAF creation and       | 15.2 Implement standards in business areas.                    |
| management process.                     | 15.3 Establish reporting mechanisms to DRO on levels of        |
| compliance.                             |                                                                |
| 16. HMRC to ensure that corporate       | 16.1 Continue working with business areas that do not have     |
| guidance is followed and that all areas | retention policies for their information.                      |
| have approved retention and disposal    | 16.2 Develop a process that will facilitate 'Spot Checking' of |
| schedules that are fully implemented.   | adherence to retention policies in business areas.             |
| 17. HMRC to implement a systematic      | 17.1 Establish the scope of the problem and identify short,    |
| approach to managing paper based        | medium and long term solutions for paper based assets.         |
| records.                                | 17.2 Develop options for digitising and minimising paper       |
| collections.                            |                                                                |
| 18. HMRC should incorporate digital     | 18.1 Work with stakeholders to improve the change process.     |
| continuity into HMRC's Gateway          | 18.2 Publish and implement policy and strategy for digital     |
| process for managing ongoing            | continuity.                                                    |
| change.                                 |                                                                |
| 19. HMRC needs to engage with its       | 19.1 Engage with Departmental IT providers and review          |
| supplier to clarify the contractual     | contractual responsibilities for Digital Continuity.           |
| responsibilities for digital continuity |                                                                |
| and agree ongoing support in            |                                                                |
| managing and maintaining digital        |                                                                |
| community.                              |                                                                |
| 20. HMRC should undertake a full        | 20.1 Review current IT Architecture change process and assess  |
| impact assessment prior to any          | effectiveness prior to any proposed change.                    |
| technological change that may affect    |                                                                |
| the completeness, availability and      |                                                                |
| usability of the Department's           |                                                                |
| information assets.                     |                                                                |
| 12 months                               |                                                                |
| 6 months to 3                           |                                                                |
| years                                   |                                                                |
| 12 months to 3                          |                                                                |
| years                                   |                                                                |
| 12 months to (5                         |                                                                |
| years                                   |                                                                |
| 12 months                               |                                                                |
| 3 years                                 |                                                                |
| 3 years                                 |                                                                |
| Recommendation                                          | Actions                                                         |
|---------------------------------------------------------|-----------------------------------------------------------------|
| 21. HMRC should undertake a limited                     | 21.1 Republish the definition of a BDApp.                       |
| review of BDApps with respect to                        | 21.2 Ensure that BDApps appear on asset registers and that      |
| digital continuity in order to manage                   | digital continuity forms part of the review.                    |
| and mitigate the risks of these                         |                                                                 |
| applications until a longer term                        |                                                                 |
| solution has been agreed.                               |                                                                 |
| 22. HMRC to carry out assurance that                    | 22.1 Review e-mail assurance process in Lines of Business.      |
| all staff, including managers leading                   | 22.2 Communicate best practice for e-mail housekeeping.         |
| by example, adhere to the email                         |                                                                 |
| policy and do regular 'housekeeping'                    |                                                                 |
| of their records.                                       |                                                                 |
| 23. HMRC should develop information                     | 23.1 Expand work to engage with existing and emerging KIM       |
| networks to share good practice                         | communities                                                     |
| across the organisation and build a                     | 23.2 Identify synergies with other Departmental initiatives.    |
| professional community of shared                        |                                                                 |
| interest in KIM.                                        |                                                                 |
| 24. HMRC should clarify its guidance                    | 24.1 Identify best practice in conjunction with People Function |
| on how internal personal information                    | and Security.                                                   |
| should be managed to increase                           | 24.2 Review and publicise guidance on managing employee         |
| compliance across the Department.                       | information.                                                    |
| 25. HMRC to assess the validity of                      | 25. Benchmark arrangements employed by OGDs and submit          |
| incorporating a review date in its                      | findings / recommendations for senior management approval       |
| Gateway memorandum of                                   |                                                                 |
| understanding covering use of its                       |                                                                 |
| data.                                                   |                                                                 |
| 26. HMRC to monitor whether data is                     | 26.1 Review current arrangements in line with draft ICO Code.   |
| being used as prescribed in the                         | 26.2 Explore benchmarking Other Government Departments          |
| Gateway Agreements.                                     | (OGDs)                                                          |
| 27. HMRC should identify what further                   | 27.1 Review with directorate Project Group consulting with      |
| information it can make available as                    | Cabinet Office and Office of Public Sector Information.         |
| part of the drive to open up public                     |                                                                 |
| data.                                                   |                                                                 |
| 28. HMRC needs to  further improve                      |                                                                 |
| assurance of third party contractors                    |                                                                 |
| 28.1 Review with the Supplier Security Assurance Group. |                                                                 |
| 28.2 Revise and implement output as appropriate.        |                                                                 |
| 6 - 12 months                                           |                                                                 |
| 6 - 12 months                                           |                                                                 |
| 6 months - 3                                            |                                                                 |
| years                                                   |                                                                 |
| 12 months                                               |                                                                 |
| 6 - 12 months                                           |                                                                 |
| 6 months                                                |                                                                 |
| 12 months                                               |                                                                 |
| 12 months                                               |                                                                 |
| Recommendation                                    | Actions                                                          | Timescale    |
|---------------------------------------------------|------------------------------------------------------------------|--------------|
| 29. HMRC to reinforce the usage of                | 29.1 Establish a suitable communications strategy and include    |              |
| the Data Security Handbook's                      | topic in planned Security events.                                |              |
| guidance on Protective Marking to all             |                                                                  |              |
| staff.                                            |                                                                  |              |
| 30. HMRC should ensure that the                   | 30.1 Ensure resource plans reflect KIM roles                     | 12 months    |
| individuals' assigned KIM roles are               |                                                                  |              |
| given the appropriate amount of time              |                                                                  |              |
| and support to meet their KIM                     |                                                                  |              |
| responsibilities                                  |                                                                  |              |
| 31. HMRC must exercise control over               | 31.1 Establish quality review procedures for Line of Business    |              |
| the business areas when they adopt,               | generated guidance and policies.                                 |              |
| amend and publish KAI policies to                 |                                                                  |              |
| ensure that only the latest versions of           |                                                                  |              |
| the policies are utilised.                        |                                                                  |              |
| 32. HMRC to provide supplementary                 | 32.1 Review education & awareness options.                       |              |
| material to support the KIM e-learning            | 32.2 Review Data Security handbook content.                      |              |
| package or incorporate this into the              |                                                                  |              |
| Data Security Handbook.                           |                                                                  |              |
| 33. HMRC should include KIM training              | 33.1 Review Induction Checklists with all stakeholders to        |              |
| within induction training for new staff.          | ensure consistent messages.                                      |              |
| 33.2 Amend checklists and process as appropriate. |                                                                  |              |
| 33.3 Develop new training modules as required     |                                                                  |              |
| 34.  HMRC should implement                        | 34.1 Conduct a training needs analysis and develop content for   |              |
| appropriate KIM training for each of              | each of the KIM roles, incorporating the output of the review of |              |
| the specific Departmental KIM roles.              | competencies/capabilities.                                       |              |
| 35. HMRC should incorporate KIM                   | 35.1 Continue with the existing KIM Pacesetter project and       |              |
| into Pacesetter principles to support             | develop strategy for putting KIM into Pacesetter.                |              |
| raising the awareness and the                     |                                                                  |              |
| benefits of KIM across the                        |                                                                  |              |
| Department.                                       |                                                                  |              |
| 36. HMRC should review and assess                 | 36.1 Analyse the results from the latest KIM Awareness survey    |              |
| how to engage middle managers in                  | and identify areas for improvement.                              |              |
| supporting the KIM agenda.                        | 36.2 Identify with focus groups on the best way to engage with   |              |
| middle managers.                                  |                                                                  |              |
| 6 months                                          |                                                                  |              |
| 12 months - 3                                     |                                                                  |              |
| years                                             |                                                                  |              |
| 12 months                                         |                                                                  |              |
| 12 months                                         |                                                                  |              |
| 12 months                                         |                                                                  |              |
| 12 months                                         |                                                                  |              |
| 12 months                                         |                                                                  |              |
| Recommendation                      | Actions                                                           |
|-------------------------------------|-------------------------------------------------------------------|
| 37. HMRC should establish formal    | 37.1 Identify the current 'exit and handover' processes           |
| handover procedures to capture      | 37.2 Review with stakeholders and amend processes as              |
| knowledge on internal transfer.     | necessary.                                                        |
| 38. HMRC should establish an online | 38.1 Identify opportunities for online knowledge sharing, line to |
| KIM space to capture and share      | ongoing associated projects.                                      |
| examples of good KIM practice.      | 38.2 Ensure communication of outputs across HMRC.                 |
12 months 
12 months