GUIDELINE INFORMATION MANAGEMENT (IM) PROGRAM PLAN

Gvernment f Newfundland and Labradr Office f the Chief Infrmatin Officer Infrmatin Management Branch GUIDELINE INFORMATION MANAGEMENT (IM) PROGRAM PLAN Guideline (Definitin): OCIO Guidelines derive frm Infrmatin Management and Prtectin Plicy, TBM 2009-335 apprved by Treasury Bard n Nvember 19, 2009. Guidelines are recmmended actins, general appraches and peratinal behavirs. They recmmend actins and are nt cmpulsry, as they take int cnsideratin the varying nature f the infrmatin management prgrams. Guidelines are generally a descriptin that clarifies what shuld be dne and hw t achieve the bjectives set ut in plicies and directives (surce: ISO/IEC 17799:2005). Issuing Branch Apprval Date Infrmatin Management Branch Review Date 2011 04 04 OCIO TRIM Number Authrizing Directive DOC04592/2011 Infrmatin Management and Prtectin Plicy, TBM 2009-335 (Where applicable) GRC Apprval Date 2011 06 15 Related Directives Related Standards Related Guidelines See References APPROVAL AND SIGN OFF Executive Directr, Infrmatin Management Branch (name) (signature) (date) Nte: Questins related t this guideline shuld be frwarded t im@gv.nl.ca

TABLE OF CONTENTS 1.0 Overview... 3 2.0 Scpe... 3 3.0 Backgrund... 3 4.0 Recmmended Apprach... 4 4.1 Review IM Drivers and Requirements:... 5 4.2 Identify Business Alignment Requirements... 5 4.3 Perfrm Current State Assessment... 6 4.4 Set Gals and Objectives... 6 4.5 Identify Services... 6 4.6 Define Service Management Prcesses... 8 4.7 Plan Educatin and Awareness... 8 4.8 Define Resurce Requirements and Allcatin... 9 4.9 Establish Gvernance and Organizatin... 9 4.10 Establish Prgram Management Framewrk... 9 4.11 Identify Perfrmance Management and Reprting Requirements... 10 4.12 Obtain Prgram Plan Apprval... 10 5.0 Glssary... 10 5.1 Acrnyms... 10 6.0 References... 11 7.0 Revisin Histry... 11 Appendix A: Sample Infrmatin Management (IM) Gals and Objectives Tracking Table... 12 Appendix B: OCIO Infrmatin Management Branch Service Catalg... 13 DOC04592/2011 Page 2 f 13

INFORMATION MANAGEMENT (IM) PROGRAM PLAN GUIDELINE 1.0 Overview An Infrmatin Management (IM) Prgram Plan utlines hw IM wrks in a department. This includes gvernance, rganizatin, management, services, perfrmance management and reprting. This guideline is designed t assist public bdies in the Gvernment f Newfundland and Labradr t develp an apprpriate Infrmatin Management (IM) Prgram Plan that will serve t drive the design, implementatin, peratin and management f an effective IM Prgram. 2.0 Scpe This Guideline applies t r may be used by all public bdies (hereafter referred t as departments), as defined in the Management f Infrmatin Act. The audience fr this guideline includes all individuals respnsible fr the peratin f an IM prgram within their department. 3.0 Backgrund The IM Prgram Plan brings t life hw the IM capabilities and services are created, delivered and managed. It is a blueprint fr IM within the department and a very useful guide fr the typical emplyee in fulfilling their jb respnsibilities. Put simply, the IM Prgram Plan has an peratinal perspective and describes: What IM services, prjects, activities and events are prvided t whm, when and why; Hw they are prvided r delivered, and by whm; and Hw they are planned and managed t ensure end user and management satisfactin. Implementing an IM Prgram Plan will cntribute t the fllwing desired utcmes: Increased quality f IM Prgram planning, service delivery, management and related decisin-making; Increased cnfidence that the department is implementing a reasnable IM Prgram, including plicies, services, prcedures, standards and guidelines in accrdance with requirements f the Management f Infrmatin Act and the Infrmatin Management and Prtectin Plicy; Better-managed, aligned and missin-enabling IM services; Greater relevance and effectiveness f IM thrugh the implementatin f the IM Prgram Plan; Better cllabratin and crdinatin amng the IM rganizatin, its IM service delivery partners, the end user cmmunity and ther stakehlders; and Increased cnfidence that IM stakehlders requirements are being satisfied. DOC04592/2011 Page 3 f 13

4.0 Recmmended Apprach IM Prgram planning fllws a similar prcess t business and strategic planning, but is entirely fcused n the develpment and delivery f an IM Prgram that supprts the business missin and business peratins f the department. The apprach described in this dcument can be tailred by the department as required t meet its unique mandate and lines f business. This prcess cnsists f the fllwing activities: Review IM Drivers and Requirements - Identify what is driving IM including the business, legal, regulatry and ther cmpliance requirements; Identify Business Alignment Requirements - Identify hw the IM Prgram must align with internal and external linkages; Perfrm Current State Assessment - Examine hw IM is currently functining within the department, in ther similar rganizatins and what varius external IM public bdies and standards setting bdies are ding in IM. Identify any gaps, deficiencies, lessns learned elsewhere and pprtunities fr imprvement; Set Gals and Objectives - Set gals, bjectives and pririties fr IM fr the planning perid t lay ut what IM must d t supprt the business strategy and business peratins f the department; Identify Services Identify what IM services will be prvided t whm, when, where including externally supplied and internal services. Cnsider als what IM prjects and ther IM activities and events will be undertaken as part f the IM Prgram; Define Service Management Prcesses Outline hw services will be delivered as a part f the prgram; Plan Educatin and Awareness What training and awareness activities and events will be undertaken; Define Resurce Requirements What resurces will be required t deliver the IM Prgram, including peple, funding and facilities; Establish Gvernance and Organizatin Explain the structure f IM in the department and hw it will be gverned; Establish IM Prgram Management Framewrk Hw will the IM Prgram be managed and delivered, including resurce allcatin and management and IM Service Delivery; Identify Perfrmance Measurement and Reprting Requirements IM Perfrmance Measurement and Reprting requirements track hw the prgram is prgressing accrding t the plan; Obtain Prgram Plan Apprval Once cmpleted, the IM Prgram Plan is presented t the Executive fr cnsideratin and apprval. The fllwing sectins include detailed descriptins f what needs t be dne at each step in the IM Prgram planning prcess. DOC04592/2011 Page 4 f 13

4.1 Review IM Drivers and Requirements: IM Drivers and Requirements identify what is driving IM including the business, legal, regulatry and ther cmpliance requirements. Cmpleting this step will enable thse develping the IM plan t knw what it is that the business intends t d and hw IM can best supprt the business strategy and peratins with the right IM services. This is usually dne by reviewing the fllwing surces f infrmatin: Business Strategy Since IM must supprt the business peratins f the department, IM needs t understand the business strategy and bjectives as set ut in the department s business plan. Ideally, the business plan shuld cntain directin frm Senir Management n plicy, plans, pririties, bjectives, desired utcmes, and may als include specific directin r bjectives fr IM; IM Visin and Guiding Principles Defines the strategic directin and guidance fr IM. The guideline Infrmatin Management (IM) Visin, Missin and Guiding Principles details hw t establish these fundatinal cmpnents f the IM Prgram; Business Requirements what IM requirements need t be fulfilled and what IM services d the varius stakehlders require; IM Legal and Regulatry Framewrk review all f the IM Legal and Regulatry requirements, including all IM Cmpliance requirements and hw the IM Legal and Regulatry Framewrk and ther IM cmpliance requirements are t be managed. The guideline Infrmatin Management (IM) Legal and Regulatry Framewrk utlines hw t establish this at a departmental level. 4.2 Identify Business Alignment Requirements IM needs t be aligned within the department and with external suppliers and stakehlders in rder t best supprt the department. This is usually dne by aligning and harmnizing the IM Prgram Plan with the department s strategic / business plan, strategic HR plan, Business Cntinuity Plan and ther similar plans and undertakings such that IM is part f the essential business fabric f the department and supprts the department s missin. Gd practice wuld be t develp the IM Prgram Plan in parallel with the department s business plan t ensure alignment and synchrnizatin f bjectives and services. In this apprach, the department wuld fllw this prcess: First, the business planners publish business planning guidance including the business planning prcess and schedule fr all elements f the department; Secnd, the Executive r Senir Management may als prvide specific IM guidance that must be cnsidered in the develpment f the IM Prgram Plan; Third, IM and the ther business areas f the department crdinate their planning activities such that the business requirements are knwn t IM and such that IM can plan t supprt the business requirements; Furth, the Executive r Senir Management wuld review and apprve the IM Prgram Plan befre it is reviewed and integrated as part f the department s business planning prcess; and Fifth, the department s business planners wuld review business plans and the IM Prgram Plan t ensure adequate alignment and synchrnizatin. DOC04592/2011 Page 5 f 13

4.3 Perfrm Current State Assessment Departments that have recently cmpleted an assessment using the Infrmatin Management Capacity Assessment Tl (IMCAT) will have identified: Hw IM is currently functining within the department and in ther similar rganizatins; Varius external IM bdies and standards setting bdies are ding in IM; and Gaps, deficiencies, lessns learned elsewhere and pprtunities fr imprvement. The findings summarized in the IMCAT reprt may need t be updated t reflect changes that have ccurred since its cmpletin r any department specific requirements. This infrmatin will be used t supprt the requirements described in subsequent sectins. 4.4 Set Gals and Objectives The IM Prgram Plan must define the gals and bjectives fr IM within the department and explain hw these will be attained. It will describe hw the business requirements, IM legal and regulatry requirements and the business peratins f the department will be supprted thrugh the prvisin f IM services and the cmpletin f IM prjects and activities. This apprach will enable the IM Prgram planner t map IM bjectives t each specific IM driver r business requirement, t explain what are the measures and indicatrs t evaluate the achievement f that bjective, and t define what services and resurces are required fr IM t attain that bjective. A sample IM Gals and Objectives Tracking Table is includes in Appendix A. 4.5 Identify Services The IM Prgram Plan must identify the IM services that are available externally and internally. This can be thught f as the IM service catalgue fr the department, and wuld serve as a useful reference fr staff at all levels. 4.5.1 Internal Services The IM Prgram Plan shuld describe the IM services that are prvided by the department, including thse supplied by its IM rganizatin and any ther IM services that are prvided frm ther parts f the department. The IM Prgram Plan shuld prvide the fllwing infrmatin: IM Service Descriptin - Describe each internal IM service, as prvided by the supplier f that service (nrmally the IM rganizatin); IM Service Prvisining - Identify wh prvides the IM service, the IM service manager and any cnditins f use; IM Service Management Identify wh in the department s IM rganizatin is the pint f cntact fr that service, hw service management will wrk, and hw prblems r issues will be handled and managed; The OCIO Infrmatin Management Branch Service Catalg, included in Appendix B, prvides and example f the type f infrmatin, level f detail, etc that shuld be included. Examples f internal IM services include: DOC04592/2011 Page 6 f 13

IM Advisry Services advice and guidance n IM Plicy, prcedures, standards and guidelines; Electrnic Dcuments and Recrds Management System - TRIM management and scanning f paper-based dcuments Recrds Management Classificatin System Recrds Retentin and Dispsal Schedule develpment and management Cllectins management recrds rms, strage cntainers, shelving Libraries publicatin cllectins IM Facilities file and recrds rms, mail distributin system, Strage physical and electrnic Infrmatin Prtectin / Infrmatin Security Management services related t the prtectin and security f infrmatin assets created, used and managed by the department. This shuld address the fur cmpnent parts f Security: Infrmatin Security the plicies and prcedures based n sensitivity and cnfidentiality fr the creatin, handling, use, strage, cnveyance and dispsitin f infrmatin, including: Security / Sensitivity System criteria fr determining what cnstitutes a cnfidential r sensitive recrd; Access Cntrls and Access Management cntrl f the assignment f access permissins t individuals such that they may access sensitive r cnfidential infrmatin held in physical and / r electrnic recrds; Vital Recrds - Vital recrds are recrds that are vital t the cntinuing functining f the rganizatin. These recrds are essential fr preserving, cntinuing r recnstructing the peratins f a department and prtecting the rights f the rganizatin, its emplyees and its stakehlders; Access t Infrmatin Requests a service gverned by the Access t Infrmatin and Prtectin f Privacy Act (ATIPPA) that prvides access t, but als specific prtectins fr, gvernment recrds (including persnal infrmatin) in the custdy and cntrl f a department; Physical Security f facilities (ffices, rms and wrk areas) and strage cntainers used t stre infrmatin (such as filing cabinets and lckable cmpartments in wrk statins); Persnnel Security may include backgrund checking f selected emplyees wh handle certain sensitive and / r cnfidential infrmatin 4.5.2 External Services External services fall int tw categries. These are services prvided by the OCIO and services prvided by third party vendrs. The IM Prgram Plan shuld describe the externally supplied IM services that the department will use, explaining: IM Service Descriptin and Specificatins Prvided fr each external IM service, as prvided by the supplier f that service; DOC04592/2011 Page 7 f 13

Basis - Under what cntract, arrangement r agreement is the IM service being prvided, including cnditins f use; IM Service Prvisining - Identify wh prvides the IM service, the IM service manager and any cnditins f use; and IM Service Management Identify wh in the department s IM rganizatin is the pint f cntact fr that service, hw service management will wrk, and hw prblems r issues will be handled and managed, and hw the cntract / agreement itself will be managed. The OCIO supplies cre IM and Infrmatin Technlgy (IT) services t gvernment departments. See the OCIO Infrmatin Management Branch Service Catalg included in Appendix B fr a detailed descriptin f the services prvided by the IM Branch, which fcus n plicies, standards and best practices fr IM. Descriptins f IT services are available n the OCIO Website. All services are prvided and managed under the terms f the Service Level Agreement that exists between the OCIO and the department. External IM Services are als be prvided by third party vendrs. In many cases, cntracting fr these external IM services is managed by central agencies (such as the OCIO r Gvernment Purchasing Agency) thrugh Master Standing Agreements. All departments are able t access IM services under such agreements. Examples include: Offsite Strage fr recrds, backup media and Vital Recrds; Physical Destructin such as shredding services. Cntact yur manager f financial peratins t access master standing ffer agreements related t IM. 4.6 Define Service Management Prcesses The IM Prgram Plan must define hw IM services will be managed within the department. IM Service Management shuld define fr each service: Service Descriptin see abve; Rles and Respnsibilities - in service delivery and management Service Standards including fr example availability f services Service Management / Service Level Management hw changes, prblems and issues are managed; and Service Cntinuity Management t what extent and hw the IM service will respnd t disruptive events and t what extent service cntinuity will be prvided during a disruptive event. The IM Service Cntinuity Plan must be clsely aligned with the department s Business Cntinuity Plan and must describe the arrangements that will be enacted t prvide fr a required and cntinuing level f IM service that supprts business needs during a disruptive event. 4.7 Plan Educatin and Awareness The IM Prgram Plan must cntain an IM educatin and awareness cmpnent t accmmdate the needs f bth departmental emplyees and IM practitiners. Educatin and awareness must be recgnized as an imprtant cmpnent f the IM prgram. Withut educatin and awareness: DOC04592/2011 Page 8 f 13

Emplyees may nt understand their IM respnsibilities as public emplyees IM practices may be incnsistent acrss the department Emplyees may nt be aware f new plicies, standards and guidelines related t IM The fllwing guidelines are used t develp departmental IM Educatin and Awareness Plans: Infrmatin Management (IM) Educatin and Awareness fr Gvernment Emplyees Educatin and Awareness fr Infrmatin Management (IM) Practitiners 4.8 Define Resurce Requirements and Allcatin The IM Prgram Plan shuld present the resurce requirements necessary t deliver the prgram, including: Funding - requirements fr all csts fr internal and external IM services, perating csts, persnnel csts, and ther csts fr facilities, equipment and supplies; Human Resurces - Requirements fr the numbers and types f staff, including: Salary; and Training and develpment csts; Facilities the facilities and space required, including any fit up csts fr shelving, physical security and envirnmental cntrls (fr paper based recrds). These resurce requirements shuld be develped and presented in the frmat required by the business planning prcess fr ease f integratin with ther budgets and cst prjectins. 4.9 Establish Gvernance and Organizatin The IM Prgram Plan shuld describe the IM Gvernance and Organizatin mdel, Develpment f this mdel is described in the Guideline Infrmatin Management (IM) Gvernance, Accuntability and Organizatin. Fr the purpse f the plan, this infrmatin can be summarized and updated as required. 4.10 Establish Prgram Management Framewrk The IM Prgram Management Framewrk shuld describe hw IM is managed within the department. It shuld explain: IM Prgram Management hw the management f the IM Prgram Plan and its varius cmpnents, including IM services, prjects, activities, events, training, prfessinal develpment, career planning, perfrmance appraisal and ther undertakings are managed, such as: A regular recurring IM rganizatin management team meeting t review IM Prgram results, perfrmance, status, issues and prblems; Regular reprting f IM Prgram results t senir management. DOC04592/2011 Page 9 f 13

Resurce Management, including human resurces, funding and facilities hw budgets are planned, apprved, and managed Crdinatin Mechanisms hw the management and delivery f the IM Prgram will be crdinated within the department. These mechanisms are usually fund in the planning prcess, in gvernance mechanisms, in recurring department management meetings where the IM directr r manager will participate, and in special task teams frmed t address a specific prblem. 4.11 Identify Perfrmance Measurement and Reprting Requirements The IM Prgram Plan must include perfrmance measurement and reprting requirements t track hw the prgram is prgressing accrding t the plan. This includes what gets reprted, hw it gets reprted, and t whm it gets reprted, including t senir management, the Executive, IM management, the end user cmmunity and ther stakehlders. The Guideline Infrmatin Management (IM) Perfrmance Measurement utlines hw t develp IM perfrmance management and reprting requirements. 4.12 Obtain Prgram Plan Apprval The IM Prgram plan must be reviewed as apprpriate by departmental stakehlders as per established departmental prtcls. The final IM Prgram Plan must be apprved by the Executive. 5.0 Glssary Infrmatin Management IM Visin TRIM 5.1 Acrnyms ATIPPA GNL IM IMCAT OCIO Access t Infrmatin and Prtectin f Privacy Act Gvernment f Newfundland and Labradr Infrmatin Management Infrmatin Management Capacity Assessment Tl Office f the Chief Infrmatin Officer DOC04592/2011 Page 10 f 13

6.0 References Management f Infrmatin Act Infrmatin Management and Prtectin Plicy, TBM 2009-335 Guideline Educatin and Awareness fr Infrmatin Management (IM) Practitiners Guideline Infrmatin Management (IM) Educatin and Awareness fr Gvernment Emplyees Guideline Infrmatin Management (IM) Gvernance, Accuntability and Organizatin Guideline Infrmatin Management (IM) Legal and Regulatry Framewrk Guideline Infrmatin Management (IM) Perfrmance Measurement Guideline Infrmatin Management (IM) Visin, Missin and Guiding Principles 7.0 Revisin Histry Date Reviewed Reviewed By 2011-01-19 Iris Pwer, Directr f Infrmatin Services 2011-03-08 Shelley Smith, Executive Directr Infrmatin Management 2011-03-17 Infrmatin Management Standards Bard (IMSB) 2011-04-04 Gvernment Recrds Cmmittee (GRC) DOC04592/2011 Page 11 f 13

Appendix A: Sample Infrmatin Management (IM) Gals and Objectives Tracking Table S:\Infrmatin Management\IMCASa DOC04592/2011 Page 12 f 13

Appendix B: OCIO Infrmatin Management Branch Service Catalg S:\Infrmatin Management\IMCAT B DOC04592/2011 Page 13 f 13