| Timescale                                                                            | Owner                                     |
|--------------------------------------------------------------------------------------|-------------------------------------------|
| Department for Work and Pensions (DWP) Information Management Assessment Action Plan |                                           |
| No.                                                                                  | Recommendation                            |
| high/medium/low                                                                      |                                           |
| 1                                                                                    | DWP should ensure that it has a           |
| holistic strategy for corporate records                                              |                                           |
| management (RM) that reflects the                                                    |                                           |
| value of information and importance                                                  |                                           |
| of record keeping has greater profile                                                |                                           |
| and recognition across the                                                           |                                           |
| organisation                                                                         |                                           |
| high                                                                                 | 31/07/2015 Knowledge and Information      |
| champion for RM                                                                      | Management Division                       |
| 1b                                                                                   | Using the senior champion for RM to       |
| promote the strategy across the                                                      | Management Division                       |
| organisation                                                                         |                                           |
| 1c                                                                                   | Developing an implementation plan for     |
| the strategy                                                                         | Management Division                       |
| 1d                                                                                   | Defining critical success factors for the |
| new strategy                                                                         | Management Division                       |
| 1e                                       | Ensuring that work to develop a new    | high   | 31/05/2016 onwards Collaboration             |
|------------------------------------------|----------------------------------------|--------|----------------------------------------------|
| Electronic Document and Records          |                                        |        |                                              |
| Management System (EDRMS) solution       |                                        |        |                                              |
| is a core part of this                   |                                        |        |                                              |
| Services/Knowledge and                   |                                        |        |                                              |
| Information Management                   |                                        |        |                                              |
| Division                                 |                                        |        |                                              |
| 2                                        | DWP needs to establish concrete        |        |                                              |
| plans to implement a solution for        |                                        |        |                                              |
| managing unstructured corporate          |                                        |        |                                              |
| digital information to replace the print |                                        |        |                                              |
| to paper policy.                         |                                        |        |                                              |
| 2a                                       | Defining business requirements for RM, | high   | 30/09/2015 Knowledge and Information         |
| for example, around search, data         | Management Division                    |        |                                              |
| sharing, metadata, access management     |                                        |        |                                              |
| and disposal, and that they guide the    |                                        |        |                                              |
| implementation of an EDRMS               |                                        |        |                                              |
| 2b                                       | Collaborating and learning from the    | high   | 31/05/2016 onwards Knowledge and Information |
| experience of other Departments that     |                                        |        |                                              |
| have recently rolled out EDRMS           |                                        |        |                                              |
| Management Division/                     |                                        |        |                                              |
| Collaboration Services                   |                                        |        |                                              |
| solutions.                               |                                        |        |                                              |
| 2c                                        | A plan to identify key corporate           | high   | 30/09/2016 Knowledge and Information    |
|-------------------------------------------|--------------------------------------------|--------|-----------------------------------------|
| information on the shared drives and      | Management Division                        |        |                                         |
| migrate this to the new EDRMS, to         |                                            |        |                                         |
| freeze shared drives to new content       |                                            |        |                                         |
| once the EDRMS has been rolled out,       |                                            |        |                                         |
| and switch off the shared drives once the |                                            |        |                                         |
| new system is established                 |                                            |        |                                         |
| 2d                                        | Training and supporting staff in using the | medium | 31/03/2016 Knowledge and Information    |
| new EDRMS                                 | Management Division/                       |        |                                         |
| Collaboration Services                    |                                            |        |                                         |
| 2e                                        | Applying retention rules to Lync and       | medium | 31/08/2015 Technology                   |
| making it clear to staff for what exact   |                                            |        |                                         |
| purpose they should be using this         |                                            |        |                                         |
| system                                    |                                            |        |                                         |
| 2f                                        | Ensuring that there is a process for       | medium | 31/082015                               |
| capturing any key corporate information   |                                            |        |                                         |
| from Drupal, applying retention rules,    |                                            |        |                                         |
| and making it clear to staff exactly what |                                            |        |                                         |
| they should be using this system for      |                                            |        |                                         |
| 3                                         | DWP should devise a plan for               |        |                                         |
| embedding digital continuity (the         |                                            |        |                                         |
| ability to find, open, work with,         |                                            |        |                                         |
| understand and trust information for      |                                            |        |                                         |
| as long as you need to) into business     |                                            |        |                                         |
| as usual processes.                       |                                            |        |                                         |
| 3a                                       | Fully recognising and managing risks to    | high   | 31/08/2015 Knowledge and Information    |
|------------------------------------------|--------------------------------------------|--------|-----------------------------------------|
| the continuity of digital information as |                                            |        |                                         |
| part of the risk management process      |                                            |        |                                         |
| Management Department/                   |                                            |        |                                         |
| Information Systems                      |                                            |        |                                         |
| Owners/ Risk Management                  |                                            |        |                                         |
| Division                                 |                                            |        |                                         |
| 3b                                       | Building digital continuity into the       | medium | 31/10/2015 Knowledge and Information    |
| information asset management process     | Management Department                      |        |                                         |
| as suggested in the 2011 DWP Digital     |                                            |        |                                         |
| Continuity Policy                        |                                            |        |                                         |
| 3c                                       | Surveying digital information held on      | high   | 31/08/2015 Knowledge and Information    |
| shared drives as part of the preparation | Management Department                      |        |                                         |
| for moving to an EDRMS. This could be    |                                            |        |                                         |
| done in a similar way to the paper file  |                                            |        |                                         |
| audits, asking business areas to report  |                                            |        |                                         |
| on what is held in the shared drives     |                                            |        |                                         |
| 3d                                       | Negotiating a slot to run The National     | medium | 31/08/2015 Technology                   |
| Archives' Digital Record Object          |                                            |        |                                         |
| IDentification (DROID) tool, or similar, |                                            |        |                                         |
| would be particularly helpful in         |                                            |        |                                         |
| determining how much duplicate           |                                            |        |                                         |
| information is held and in identifying   |                                            |        |                                         |
| formats and age of information.          |                                            |        |                                         |
| 3e                                         | Ensuring that Knowledge and             | medium   | 31/07/2015 Knowledge and Information    |
|--------------------------------------------|-----------------------------------------|----------|-----------------------------------------|
| Information Management Department          | Management Division                     |          |                                         |
| staff are involved in any IT developments  |                                         |          |                                         |
| that would have an impact on               |                                         |          |                                         |
| Knowledge and Information                  |                                         |          |                                         |
| Management Department responsibilities     |                                         |          |                                         |
| from the outset and that business          |                                         |          |                                         |
| requirements for IM are a core part of     |                                         |          |                                         |
| these projects.                            |                                         |          |                                         |
| 3f                                         | Ensuring that the need to keep          | medium   | 31/12/2015                              |
| to be identified                           |                                         |          |                                         |
| information within benefits delivery       |                                         |          |                                         |
| systems available and usable is factored   |                                         |          |                                         |
| into DWP's plan for implementing digital   |                                         |          |                                         |
| continuity as business as usual            |                                         |          |                                         |
| 4                                          | DWP should factor information and       |          |                                         |
| records management  into the way it        |                                         |          |                                         |
| defines and monitors information risk      |                                         |          |                                         |
| 4a                                         | Ensuring that the risk of not capturing | high     | 31/08/2015 Knowledge and Information    |
| and keeping the records it needs, in the   |                                         |          |                                         |
| way that it needs for as long as it needs, |                                         |          |                                         |
| Management Division/Risk                   |                                         |          |                                         |
| Management Division                        |                                         |          |                                         |
| is recognised and managed through the      |                                         |          |                                         |
| risk management framework                  |                                         |          |                                         |
| 4b                                        |  Ensuring that information risks are    | high   | 31/07/2015 Knowledge and Information         |
|-------------------------------------------|-----------------------------------------|--------|----------------------------------------------|
| discussed at Information Risk             | Management Division                     |        |                                              |
| Management Board and are given            |                                         |        |                                              |
| scrutiny by DWP Security Oversight        |                                         |        |                                              |
| Board                                     |                                         |        |                                              |
| 4c                                        | Promoting awareness of information      | medium | 31/12/2015 Knowledge and Information         |
| risks and how they should be managed      | Management Division/Risk                |        |                                              |
| Management Division                       |                                         |        |                                              |
| 5 DWP should seek to establish a more     |                                         |        |                                              |
| effective approach to monitoring and      |                                         |        |                                              |
| achieving compliance with IM and          |                                         |        |                                              |
| Records Management Policy                 |                                         |        |                                              |
| 5a                                        | Establishing a network of information   | medium | 31/08/2015 Knowledge and Information         |
| representatives across the organisation.  | Management Division                     |        |                                              |
| This should include a role description    |                                         |        |                                              |
| and training and support from the         |                                         |        |                                              |
| Knowledge and Information                 |                                         |        |                                              |
| Management team.                          |                                         |        |                                              |
| 5b                                        | Using this network to promote           | medium | 31/08/2015 onwards Knowledge and Information |
| Knowledge and Information                 | Management Division                     |        |                                              |
| Management policy and processes and       |                                         |        |                                              |
| provide training and support for staff on |                                         |        |                                              |
| information and records management in     |                                         |        |                                              |
| business areas.                           |                                         |        |                                              |
| 5c                                           | Building on the work that has already    | High   | 31/08/2015 Knowledge and Information    |
|----------------------------------------------|------------------------------------------|--------|-----------------------------------------|
| been done to monitor compliance with         | Management Division                      |        |                                         |
| the Records Management Policy using          |                                          |        |                                         |
| the Information Asset Assurance returns      |                                          |        |                                         |
| in particular, further defining what sort of |                                          |        |                                         |
| evidence business areas should provide       |                                          |        |                                         |
| in order to demonstrate compliance           |                                          |        |                                         |
| 5d                                           | Gaining greater assurance on the         | High   | 30/09/2015 Knowledge and Information    |
| content of shared drives and the             | Management Division                      |        |                                         |
| management of this content by, for           |                                          |        |                                         |
| example, extending file audits.              |                                          |        |                                         |
| 5e                                           | Considering rolling out the Essential    |        |                                         |
| Records Management campaign of bite-         |                                          |        |                                         |
| medium                                       | 31/12/2015 and                           |        |                                         |
| ongoing                                      |                                          |        |                                         |
| Knowledge and Information                    |                                          |        |                                         |
| Management Division                          |                                          |        |                                         |
| sized information on information and         |                                          |        |                                         |
| records management across other              |                                          |        |                                         |
| business areas                               |                                          |        |                                         |
| 6                                            |                                          |        |                                         |
| DWP should work towards extending            |                                          |        |                                         |
| the Knowledge and Information                |                                          |        |                                         |
| Management Division's oversight and          |                                          |        |                                         |
| control of paper records to digital          |                                          |        |                                         |
| information                                  |                                          |        |                                         |
| 6a                                         | Exploring the possibility of extending the    | medium   | 31/12/2015 onwards Knowledge and Information    |
|--------------------------------------------|-----------------------------------------------|----------|-------------------------------------------------|
| paper file audits to cover digital         | Management Division                           |          |                                                 |
| information on the shared drives, and as   |                                               |          |                                                 |
| part of this, ask business areas to report |                                               |          |                                                 |
| on disposal                                |                                               |          |                                                 |
| 6b                                         | Ensuring that all digital systems             | high     | 31/12/2015 Knowledge and Information            |
| (including benefits delivery systems and   |                                               |          |                                                 |
| the new EDRMS) have disposal built in      |                                               |          |                                                 |
| Management Division/                       |                                               |          |                                                 |
| System owners                              |                                               |          |                                                 |
| and that disposal is being actioned        |                                               |          |                                                 |
| 6c                                         | Ensuring that the Knowledge and               | medium   | 31/08/2015 Knowledge and Information            |
| Information Management                     | Management Division                           |          |                                                 |
| Division/information advocates in the      |                                               |          |                                                 |
| business are involved in the creation and  |                                               |          |                                                 |
| management of shared drives                |                                               |          |                                                 |
| 6d                                           | Beginning to devise an approach for        |
|----------------------------------------------|--------------------------------------------|
| Management Division                          | appraisal, sensitivity review and transfer |
| of digital information, particularly that on |                                            |
| the shared drives, drawing on advice         |                                            |
| from The National Archives and other         |                                            |
| government departments' work in this         |                                            |
| area                                         |                                            |