Records Management Plan: progress update review 2024

Green

Green

Green

Update required on any change.

No change.

Update required on any change.

No change.

Update required on any future change.

Green

Green

Green

Update required on any change.

No change though as a point of interest the Knowledge and Information Management Branch is now part of Digital Citizen Division having moved out of iTECS Division.

The Assessment Team thanks you for this update on internal restructuring.

No change.

Thank you for letting the Assessment Team know that there have been no changes to this Element.

Update required on any future change.

Green

Green

Green

Update required on any change.

No change.

Update required on any change.

Our Records Management Policy document (E01) has been updated to strengthen messages on recording of Microsoft Teams, Office 365 and mobile messaging relevant to the corporate record.

As mentioned previously we have a Mobile Messaging Apps – Usage and Policy (E84 – link provided) but as you are aware the First Minister commissioned an externally led review into the use of mobile messaging apps and non-corporate technology in the Scottish Government and we are currently considering the findings of that report. Both our Records Management Policy and Mobile Messaging Apps – Usage and Policy will be revised on the back of that work and we will share revised versions when they become available.

Thank you for confirming that the SG’s Records Management policy remains operational and up to date, and that appropriate revisions are being made in response to current business needs.

The Assessment Team look forward to receiving an update on Records Management Policy and Mobile Messaging Apps – Usage and Policy in due course

Green

Green

Green

Update required on any change.

No change.

Update required on any change.

We have updated the title of a couple of our level 3 folders to align with current terminology (link to updated version of E65: Scottish Government Fileplan Level 1 to 3 provided).

Thank you for this update which has been noted.

Update required on any change.

Amber

Amber

Amber

The SG have provided the Keeper with the following update regarding the gap in retention noted above: “In terms of our legacy paper records these will all continue to be managed in line with the arrangements stated in the document titled ‘Scottish Government Paper Records Retention schedule pre-eRDM’. We continue to progress the project to digitise our paper records in line with the document titled ‘Digitisation of Legacy Paper Files’.

We have this year [2022] commenced a Shared Drive Programme which will firstly see content held in ‘H Drives’ be reviewed by each individual member of staff and either added to the appropriate eRDM file where it is part of the corporate record (this exercise is to be completed by the end of July 2022) or deleted where it has no/no longer has any business value (note: any deletion of corporate information will be done in consultation with our branch). Following this we will begin the task of tackling content held on the G drive, pst files and public folders whereby business areas will be asked to review material and add any content which is for the corporate record to eRDM unless there is a valid business reason why it cannot be stored there (e.g. databases) or alternatively delete information which has no/no longer has any business value (as above any deletion of corporate information will be done in consultation with our branch).

On completion of this exercise (which will inevitably take a reasonable period of time to complete) the vast majority of information for the corporate record will be stored in eRDM (where it will be managed appropriately in line with our RMP arrangements) and those objects not stored in eRDM (e.g. databases) will be recorded as Information Assets by local Information Asset Owners which will ensure they can be appropriately managed (note: we continue to advise business areas to ensure that regular ‘snapshots’ or reporting outputs of their databases are stored in eRDM to maintain the corporate record).”

Considering this statement, the Keeper accepts that the SG recognise that retention is not yet satisfactorily applied to all public records, but he is satisfied that there is a clear methodology in action to resolve the issue while sensibly weeding-out records that are of no ongoing business value. The Keeper also notes that the project to digitise paper records is in line with the SG’s Digital First agenda.

The Keeper can agree this element of the Scottish Government’s RMP on improvement model terms. This means that the authority has identified a gap in their records management provision (there is a backlog of legacy records that do not have retention/destruction processes applied) and have put processes in place to close that gap. The Keeper’s agreement will be conditional on his being kept up-to-date with progress.

The following new eRDM file types have been created at the request of SG business areas:

• Audit and Assurance Management – close after 3 years, destroy 3 years after closure;
• European Maritime and Fisheries Fund Casework - close after 5 years, destroy 2028 as required by EC audit;
• Fisheries and Aquaculture Casework – close after 5 years, review 25 years after closure;
• Marine Environment Consenting Casework – close after 5 years, review 75 years after closure;
• Marine Environment General Licensing Casework – close after 5 years, destroy 25 years after closure;
• Ministerial Decisions Backup – close after 5 years, destroy 5 years after closure.

We have also revised the retention schedules of the following eRDM file types as follows at the request of SG business areas in line with their business requirements:

• Legal Advice Working Papers – close after 5 years, archive 15 years after closure (was previously destroy 11 years after closure);
• Rural Payments Customer Casework – close after 20 years (was 5 years), destroy 10 years after closure;

Rural Payments Agent Casework – close after 20 years (was 5 years), destroy 5 years after closure;

• Scotland Rural Development Programme RDC RP – close after 30 years (was 5 years), destroy 7 years after closure.

The project to digitise our paper records continues and work has largely been completed on closing down H drives (aside from those belonging to colleagues who are not at work as a result of long term absences) with any information which is part of the corporate record transferred into the appropriate eRDM file. A pilot exercise to test the end to end process of reviewing and managing/moving content held in public folders is about to begin following on from which we’ll begin reaching out to other business areas to continue to progress this task.

Thank you for this update which has been noted. It is great to hear that retention schedules have been updated according to changes in business requirements.

The update regarding continuing digitisation of legacy paper records is welcome. It is good to hear that the retirement of H drives has now largely been completed, aside from a few exceptions.

Further updates on the progress of the Shared Drive Programme would be welcome in future PUR submissions as the Keeper has agreed this Element on an improvement model basis.

This Element will remain at Amber as the work continues.

The following new eRDM file types have been created at the request of SG business areas:

• Cabinet Meeting Papers – close after 1 year, archive 15 years after closure;
• Fixated Threat and Persistent Correspondence – close after 1 year, destroy 2 years after closure

We have also revised the retention schedule of the following eRDM file type as follows at the request of SG business areas in line with their business requirements (NRS Depositor Liaison colleagues already aware):

• Firearms Casework – close after 5 years, destroy 20 years after closure (was close after 5 years, archive 15 years after closure)

The project to digitise our paper records continues and work has been completed on closing down H drives with any information which is part of the corporate record transferred into the appropriate eRDM files. Good progress is being made with the review and management/ movement of content held in public folders. We will continue to keep you updated with this work.

Thank you for this focused update on continuing progress in terms of records retention arrangements

This Element will remain at Amber as the work continues.

Green

Green

Green

Update required on any change.

No change.

Update required on any change.

No change.

Update required on any future change.

Green

Green

Green

The Keeper acknowledges that this arrangement is operational and public records of the SG are routinely transferred into NRS. However, the Service Level Agreement under which these arrangements operate is out-of-date. The NRS Client Management Team and the Corporate Records Manager (see element 2) have both acknowledged this discrepancy and have set up a meeting to begin taking forward the updating of these documents. The SG have also committed to provide the Keeper with a copy of the updated agreement as soon as it becomes available.

The Keeper can agree this element of the SG RMP under ‘improvement model’ terms. He can do this when he is convinced that, having identified a gap in records management provision, an authority has put appropriate process in place to close that gap.

We are currently working with NRS colleagues in relation to the arrangements for the transfer of eRDM files to NRS this year in line with agreed file retention arrangements. We would expect to complete the transfer of these records by no later than 1 September.

As mentioned at element 5 work continues on the project to digitise our paper records and to take forward the review and management/movement of information held in non-eRDM repositories such as public folders.

Unfortunately due to other work pressures on both sides it has not been possible to link in with NRS colleagues as yet on updating the Service Level Agreement and NRS selection policy. We have not lost sight of the requirement to undertake this work and will update the Keeper in due course.

The Assessment team thanks you for this update on digital archiving arrangements with NRS. The legacy paper record digitisation and Shared Drive projects, also mentioned under Element 5, are also noted with thanks.

The Team notes that pursuing an up-to-date Service-Level Agreement and selection policy with NRS has not progressed, but that this remains on the authority’s radar. It is hoped that this process will have been started at the time of the next PUR submission.

We are currently working with NRS colleagues in relation to the arrangements for the transfer of eRDM files to NRS this year in line with agreed file retention arrangements.

As mentioned at element 5 work continues on the project to digitise our paper records and to take forward the review and management/movement of information held in non-eRDM repositories such as public folders.

We have provided NRS colleagues with a draft deposit agreement (E83) which has provisionally been agreed with the Depositor Liaison Team. We will share a copy of the agreement once it has received full sign off.

Thank you for this update on the SG’s archiving and transfer arrangements, including the ongoing paper records digitisation project.

The Assessment Team notes with thanks the receipt of an up-to-date Transfer Agreement with NRS which has been signed off. This was received following the initial submission of the PUR template. Consequently, if this was a formal resubmission, it is likely that this Element would retain its Green status.

Green

Green

Green

Update required on any change.

No change.

Update required on any change.

The following documents have been updated by SG colleagues since our last Progress Update Review:

• E15: SG Risk Management Guide;
• E18: SG IT Security Policy

Links to the revised documents provided by e-mail.

Thank you for updating the Assessment Team on developments under Element 8, including regular guidance and policy review.

Update required on any change.

Green

Green

Green

Update required on any change.

No change.

Update required on any change.

The following documents have been updated by SG colleagues since our last Progress Update Review:

• E21: SG Data Protection ICO notification;
• E26: SG Subject Access – Guidance

Links to the revised documents provided by e-mail.

The Assessment Team thanks the SG for this update on Data Protection arrangements which has been noted.

Green

Green

Green

Update required on any change.

As mentioned at elements 5 and 7 work continues in our project to digitise our paper records.

No changes to report at this time.

Thank you for this update which has been noted.

Update required on any future change.

As mentioned at elements 5 and 7 work continues in our project to digitise our paper records.

No changes to report at this time.

Thank you for this update which has been noted.

Green

Green

Green

Update required on any change.

No change.

Update required on any change.

As mentioned at element 7 we have provided NRS colleagues with a draft deposit agreement (E83) will share a copy of the agreement once it has received full sign off.

Element 11:

Audit trail focuses on tracking and version control, stipulating that the location of records – whatever format – is known and changes recorded. The

Team acknowledges that the requirements under this Element continue to be met by the SG.

Update required on any future change.

Green

Green

Green

Update required on any change.

Members of the Branch are currently completing a Glasgow University course on Records Management. This will complete by the end of August 2023.

We continue to look for other relevant training opportunities and will encourage colleagues within the branch to attend where it is possible to do so in line with budgetary restraints.

Thank you for this positive update. It is very exciting to hear that opportunities have arisen for upskilling training in records management, and that this is being pursued across the branch.

Colleagues successfully completed the Glasgow University course on Records Management in 2023.

I also wanted to update you on the following in relation to records management training provided to SG staff:

• SG Induction e- learning course which all new SG staff are advised to complete. This course contains links to mandatory training (including Data Protection and eRDM) colleagues are required to complete as well as a section on Information and Records Management;
• colleagues are no longer required to complete the “Responsible for Information – General User” e- learning course;
• completion of eRDM training is mandatory for all staff before they get access to the eRDM system, this consists of SG Information Management Strategy, eRDM and Information Management basics e-learning, eRDM task based videos & quiz. We also strongly recommend to existing eRDM users that they refer to this pathway as a training refresher as often as required;
• colleagues are no longer required to complete the E25: Managing Information training;
• E32: eRDM Browser - Functionality handbook is no longer used as it has been replaced by other training materials;
• Information Management, Records Management and eRDM - Overview e-learning provides guidance on Information and Records Management;
• Mandatory Information Asset Owner (IAO) training is provided to all IAOs (Deputy IAOs are also encouraged to attend). The course provides an overview of the role, identification of information assets, records management, data protection, handling security incidents and security awareness. IAOs are invited to attend this course at least every 3 years, with those dealing with more sensitive material invited to attend annually;
• Information Management Support Officers (IMSOs) Training Pathway – this training must be completed by newly nominated IMSOs. The training comprises of an IMSO e-learning course, task-based videos and quiz. We also strongly recommend that existing IMSOs refer to this pathway as a training refresher, as often as required;
• Records Management webinars are provided on a regular basis to colleagues and go into detail about our Records Management Plan and Policy.

Thank you for this positive update regarding different types of records management training provided across SG staff. The level of training required by staff will vary considerably depending on their role, and it is clear the SG continues to implement both a general and a targeted approach.

Green

Green

Green

The Keeper would like to note that several evidence documents provided to him have no control sheet attached. Therefore, he is not able to judge who authorised them, their approval date or when they are due to be reviewed. Update required on any change.

We will endeavour to add control sheets to evidence documents which we have responsibility for and will pass this feedback to colleagues whose areas are responsible for the other documents.

It should also be noted that some of our documents are static (e.g. E48: Extract of a Chief Dental Officer file in eRDM) and others are copied and pasted from content held on Saltire hence the reason no control sheet is provided on them.

I can confirm that the following evidence documents have been updated since we submitted our Records Management Plan. I have provided copies of the latest versions of these documents:

• E04;
• E05;
• E12;
• E13;
• E14;
• E15;
• E16;
• E17
• E18;
• E19;
• E21;
• E32;
• E33;
• E35;
• E38;
• E57;
• E65

Section 1(5)(i)(a) of the Act says that an authority must keep its Records Management Plan (RMP) under review. An authority’s RMP must describe the procedures in place to regularly review it in the future.

Document control sheets are good practice as they allow for management and monitoring of regular review of all RMP-adjacent plans and policies.

Any other style of indication of authorising person, issue date and review schedule would also be acceptable.

It is positive to hear that there has been a drive to add these to relevant documentation.

The Assessment Team thanks you for providing the evidence documents listed; these have been received with thanks.

Update required on any future change.

I can confirm that the following evidence documents have been updated since we submitted our Records Management Plan. I have provided links to the latest versions of these documents:

• E01;
• E04;
• E05;
• E15;
• E17;
• E18;
• E21;
• E26;
• E31;
• E58;
• E65;
• E66

We have also added the following new documents to our evidence bank:

• E83: Deposit Agreement between NRS and SG;
• E84: Mobile Messaging Apps - Usage & Policy (including WhatsApp, Telegram, Viber and Signal)

Thank you for confirming that the SG continues to keep its Records Management plan and adjacent policy suite up to date, including adding to this suite where relevant.

Participation in the Progress Update Review (PUR) process is also commended.

Green

Green

Green

Update required on any change.

As the Keeper may have noted the UK Government has launched a revised security classification policy (to access click here) that applies to all civil servants. SG colleagues are currently working on revising the internal guidance which we provide to colleagues on this and we can share this when it becomes available.

The Team thanks SG for providing this update on the launch of a revised security classification policy. We look forward to further updates on the internal guidance in future PURS.

We have provided a link to an updated version of E31: Security Classifications which provides details of the new security classification descriptors.

Thank you for this update, and for your provision of the security Classification Descriptors document.

This has been noted.

Green

Green

Green

Update required on any change.

No change.

Update required on any change.

No change.

Update required on any change.