Information Technology: Library of Congress Needs to Implement Recommendations to Address Management Weaknesses
Published: 2015-12-02T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Library of Congress is the oldest federal cultural institution and the world's largest library. Its mission is to preserve and make available works of creativity and human knowledge, and to serve as the research arm of the U.S. Congress. In addition, the Library houses the U.S. Copyright Office, which is charged with administering the nation's copyright law. As information is increasingly created, shared, and preserved digitally, both the Library and Copyright Office rely on IT to support their missions.
GAO was asked to provide a statement summarizing its March 2015 reports on the Library's IT management and the Copyright Office's IT environment and plans for modernization. In preparing this statement, GAO relied on the work supporting these reports. GAO also interviewed Library and Copyright officials about more recent activities to implement GAO recommendations.
section_title: What GAO Found
paragraphs: In a March 2015 report, GAO identified widespread weaknesses in the Library of Congress's management of its information technology (IT) resources. These weaknesses spanned six IT management–related areas:
Strategic planning: The Library had not developed an IT strategic plan that defined what it wants to accomplish with IT and strategies for achieving those results. Such a strategic approach is essential to the Library as information is increasingly created, shared, and preserved digitally.
Investment management: The Library had not effectively implemented processes for selecting or overseeing its investments in IT. In addition, it did not have an accurate inventory of its IT assets and did not know how much it was spending on IT.
Acquisition management: The Library had not fully implemented processes for ensuring that its IT acquisitions were guided by well-developed requirements, risk management practices, and reliable cost and schedule elements.
Information security: Weaknesses in its information security and privacy programs, as well as weaknesses in technical security controls, placed the Library's systems at risk of unauthorized access, modification, or loss.
Service management: The Library's central IT office did not provide services that satisfied the other units in the organization, leading to those units engaging in overlapping and duplicative activities and purchases.
Leadership: The Library's lack of a chief information officer with adequate authority and clear responsibility for managing the agency's IT was a key contributing factor to the weaknesses GAO identified.
Since GAO issued its report, the Library has taken actions toward addressing these weaknesses; however, much more remains to be done. For example, it appointed a new chief information officer, but it remains to be seen whether this official will have clear responsibility and adequate authority to drive needed improvements.
Regarding the Copyright Office, GAO reported in March 2015 that the office's IT environment was to support its duties of receiving and examining copyright registration applications, maintaining deposited copies of copyrighted works, producing certificates of registration, and maintaining records of the transfer of copyright ownership. However, the office faced a number of IT challenges, particularly with regard to its Electronic Copyright Office system, which supports the registration of copyrights. These challenges included user complaints about the performance and usability of the system, information security weaknesses, and data retention and integrity issues, among other things. The Copyright Office was also hindered by inadequate IT services and support from the Library.
While the office had proposed investments in several IT improvement projects, it had not developed an IT strategic plan to guide its efforts and monitor progress in meeting its goals. Since GAO's review, the Copyright Office has issued an overall draft strategic plan that, among other things, describes goals and strategies for improving its IT environment.
section_title: What GAO Recommends
paragraphs: In its March 2015 reports, GAO recommended that the Library of Congress take 31 actions to address weaknesses in six IT management–related areas and that the Copyright Office, among other things, develop an IT strategic plan. The Library concurred with GAO's recommendations, but it has yet to fully implement any of the 31 actions. GAO continues to believe that actions should be taken to fully implement these recommendations. For its part, the Copyright Office has taken steps to address GAO's recommendations, such as drafting a new strategic plan.

section_title: Letter
paragraphs: Thank you for inviting me to testify at today’s hearing on ensuring the  Copyright Office and Library of Congress are able to meet the demands  of the digital age. As you know, the Library of Congress is the United  States’ oldest federal cultural institution, and its mission is to support the  Congress in fulfilling its constitutional duties and to further the progress of  knowledge and creativity for the benefit of the American people. In  addition, since the late 19th century it has housed the U.S. Copyright  Office, which is responsible for administering the nation’s copyright  system.
As technology has advanced and the needs of its users have evolved, the  Library has come to rely increasingly on information technology (IT)  systems to carry out its mission. Moreover, as we and others have  highlighted in a number of reports, the Library has long faced challenges  in effectively managing and modernizing its IT environment. In addition,  the Register of Copyrights has discussed the need for a modernized  Copyright Office, to include upgrades to its current IT environment.
In my statement today, I will summarize the results and recommendations  from two reports we issued earlier this year on the Library’s management  of the IT supporting its programs and operations and the Copyright  Office’s IT environment and plans for modernization. In preparing this  statement, we relied on the work supporting these reports, as well as  interviews conducted in November 2015 with Library and Copyright  officials to discuss efforts they had undertaken to implement our  recommendations. We also reviewed documentation provided by officials  on these efforts.
The work on which this testimony is based was conducted in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives. The reports discussed in this statement each contain  a more detailed overview of the scope and methodology of the work we  performed to conduct our reviews.
subsections: section_title: Background
paragraphs: Established in 1800, the Library of Congress is the world’s largest library  and serves as the research arm of Congress. Its collections include more  than 36 million books and other print materials, 3.5 million recordings,  13.7 million photographs, 5.5 million maps, 6.7 million pieces of sheet  music, and 69 million manuscripts. The items in its collection are received  through a variety of sources, including through the copyright registration  process administered by the U.S. Copyright Office.
Positioned within the legislative branch, the Library carries out its  operations through a number of service and support units:
The Office of the Librarian had overall management responsibility for  the Library and carried out certain executive functions.
The Congressional Research Service (CRS) is responsible for  providing Congress with nonpartisan legislative research and  analysis.
The U.S. Copyright Office is responsible for administering the  Copyright Act, including copyright registration, recordation, mandatory  deposit, and certain statutory licenses.
The Law Library provides Congress with ready access to reliable legal  materials.
Library Services develops and preserves the Library’s collections and  also included the National Library Service for the Blind and Physically  Handicapped (NLS), which directs the production of books and  magazines in Braille and recorded formats.
At the time of our review, the Office of Strategic Initiatives was  responsible for the overall digital strategic planning for the Library and  included the office of Information Technology Services (ITS), which  was to support the Library’s IT systems and infrastructure. The head  of the Office of Strategic Initiatives also served as the agency’s Chief  Information Officer.
The Office of Support Operations was to provide essential  infrastructure services to the entire Library.
subsections: section_title: IT Environment at the Library and Copyright Office
paragraphs: Like other federal agencies, the Library relies on a host of IT systems to  carry out its mission. These include standard hardware (e.g., desktop and  laptop computers, printers, and servers) and software (e.g., e-mail, word  processing and spreadsheet programs, and Internet resources), as well  as administrative and business systems, such as accounting, financial  planning and budgeting, and human resources systems.
In addition, the Library’s service units use systems that support their  specific missions. For example, NLS uses a system to manage the  production, distribution, and maintenance of audiobooks, and CRS uses  specialized software to develop its reports.
At the time of our review, much of the responsibility for managing the  Library’s IT rested with the Office of Strategic Initiatives. More specifically,  ITS, a component of the office, was responsible for supporting the other  service units by planning, designing, developing, and maintaining  systems and their supporting infrastructure.
As of September 2014, the Library had at least 380 staff across the  various service units dedicated to IT functions. In addition, it obligated at  least $119 million for IT during fiscal year 2014, with about $46 million for  staff salaries and $73 million for goods and services, among other things.  The Office of Strategic Initiatives accounted for about $72 million of the  total IT obligations across the agency, with the rest allocated to the other  service units, who also make their own investments in IT.
The Copyright Office also relies extensively on IT to carry out its mission.  It uses multiple systems to support its registration, recordation, and  licensing functions. In particular, the office’s Electronic Copyright Office  (eCO) system is used by members of the public (e.g., authors) to register  claims to a copyright and by Copyright Office staff to manage this  process.
section_title: Weaknesses in IT Management across the Library Demonstrate the Need for Stronger Leadership
paragraphs: In March 2015, we reported that the Library had serious weaknesses in  the management of IT across the organization. Specifically, the Library’s  policies, procedures, and implementation in six IT management–related  areas had significant weaknesses. These six areas were (1) strategic  planning, (2) investment management, (3) acquisition, (4) information  security and privacy, (5) service management, and (6) leadership of the  Chief Information Officer (CIO) and other key officials.
subsections: section_title: Library Lacked Tools for Effective IT Strategic Planning
paragraphs: Strategic planning is essential for an organization to define what it seeks  to accomplish, identify strategies to efficiently achieve results, and guide  its efforts. For IT, key elements are an IT strategic plan and an enterprise  architecture that, together, outline the agency’s IT goals, measures, and  timelines. In addition, effective human capital management is critical to  ensuring that an organization’s IT workforce has the necessary skills to  support its goals.
However, as we reported, the Library had not developed an IT strategic  plan that was aligned with the agency’s overall strategic plan and  included results-oriented goals and measures, strategies for achieving its  goals, and descriptions of how projects fit together to support these goals.  Specifically, the Library had drafted an IT strategic plan that addressed  some, but not all, of these elements, but at the time of our review it had  not been finalized. Thus, the Library lacked a clear vision of what it wants  to accomplish with IT and strategies for achieving those results. Such a  strategic approach is essential to the Library as information is increasingly  created, shared, and preserved digitally.
Regarding enterprise architecture, the Library had developed an  architecture that described the current state of the Library’s IT systems  and operations; however, the data supporting this effort were not  gathered from management and validated by stakeholders, calling into  question its reliability. Moreover, the architecture did not reflect the target  state of the agency’s IT, the gaps between the current and target states,  and specific steps the Library should take to move toward the target state.
The Library also fell short in its approach to IT human capital  management. Specifically, it had not assessed the gaps between the  current skills of its workforce and those that would be needed in the  future, and developed strategies to fill those gaps. While individual  service units had undertaken their own skills gap analyses, the Library  lacked an organization-wide perspective that would allow it to take a  strategic approach to ensuring an adequate IT workforce.
section_title: Selection and Oversight of Investments Was Not Effective
paragraphs: Recognized practices for managing the selection and oversight of IT  investments, such as those outlined in our IT investment management  framework, are critical to ensuring that an organization is prudently  investing in the right mix of projects to support its mission. These  practices include (1) instituting a board for making investment decisions,  (2) selecting investments that meet business needs, (3) providing  investment oversight, and (4) capturing accurate and comprehensive  information on those investments and other IT assets.
The Library had instituted an investment review board and established  elements of a process for selecting investments; however, these were not  always effective. Specifically, Library policy did not clearly define the  responsibilities of its investment board by, for example, specifying when  investment decisions should be made by the board and when they should  be elevated to the Library’s Executive Committee. Further, since the  Library did not have a fully developed IT strategic plan or enterprise  architecture, its investment management process was not fully  coordinated with these processes, limiting the agency’s ability to make  investment decisions that effectively support its mission and goals.
In addition, while the Library had developed a process for selecting  investments for funding based on a balancing of risk factors and program  benefits, it lacked policies or procedures for “re-selecting” investments for  continued funding once they were operational. This is significant because  operational investments accounted for the majority of the Library’s IT  spending. Moreover, the Library had not integrated its investment  selection and funding processes, meaning that decisions to fund projects  were not informed by the evaluation of their relative risks and benefits. In  some cases, individual service units secured funding for investments  before bringing them to the investment review board—or the investments  were not reviewed by the board at all.
Regarding investment oversight, the Library conducted assessments of  investments’ progress through reviews of variations from planned cost  and schedule baselines and the management of risk, among other things.  However, for three selected investments we reviewed, cost, schedule,  and risk data were not always complete or reliable. This limited the  Library’s awareness of potential problems and its ability to take corrective  action.
Further, the Library had not fully accounted for its IT-related expenditures  but only collected that information for the subset of investments reviewed  by the investment review board. Consequently, the Library did not know  how much it spends on IT.
Similarly, the Library’s primary inventory of IT assets (e.g., hardware such  as personal computers) was highly inaccurate. For example, the inventory  listed over 18,000 active personal computers, even though officials told  us that fewer than 6,500 personal computers were actually in use. Also,  the Library had conflicting inventories of information systems, which  disagreed on the number of systems in the agency. Specifically, Library  officials provided us with two lists of systems, one with 30 systems and  one with 46. After we raised this discrepancy, we were provided with a  revised list of 70 systems. In the absence of an accurate inventory, the  Library may be unable to effectively prevent loss or theft of assets, and it  may end up purchasing equipment that is duplicative of what it already  has on hand.
section_title: Key Acquisition Practices Were Not Followed
paragraphs: Proper implementation of key IT acquisition practices can significantly  increase the likelihood of delivering promised system capabilities on time  and within budget. These practices include, among others, risk  management, requirements development, cost estimating, and  scheduling.
However, the Library had not developed organization-wide policies in any  of these areas that fully address key practices. Partly as a result, these  practices were not fully implemented for selected investments we  reviewed. For example:
Selected IT investments did not take such risk management  measures as establishing a risk management strategy; evaluating,  categorizing, and prioritizing risks; and developing risk mitigation  strategies.
Investments did not effectively manage requirements by eliciting  stakeholder needs and prioritizing customer requirements.
Cost estimates for selected investments did not sufficiently account  for all costs, which is a foundational requirement for a reliable cost  estimate.
Schedules for the selected investments were not fully reliable  because they did not logically sequence planned activities to provide  straightforward paths of critical activities.
Without establishing and implementing these key acquisition practices,  investments may incur cost overruns and schedule slippages and fail to  deliver capabilities needed to support the Library’s mission.
section_title: Security and Privacy Weaknesses Threatened Library Information and Systems
paragraphs: Protecting its data and information systems is essential both to defend an  agency’s assets against cyber attacks and to protect sensitive information  entrusted to it by the public. To do this, agencies should establish  information security and privacy programs and effectively implement  technical security and privacy controls, such as those outlined by the  National Institute of Standards and Technology (NIST).
Consistent with NIST guidance, the Library had established security and  privacy programs by delineating roles and responsibilities and developing  policies and procedures. For example, it assigned security-related roles to  appropriate officials, including the Librarian, Deputy Librarian, CIO, and  Chief Information Security Officer. The Library also documented  information security policies and procedures to safeguard its information  and systems. Similarly, the Library developed policies to protect the  privacy of data processed by its systems and designated the General  Counsel as the agency’s Chief Privacy Officer, with responsibility for  managing the protection of personally identifiable information maintained  by Library systems.
However, the Library had not fully implemented key elements of its  information security and privacy programs. For example, while the Library  did establish and implement a process for reporting and responding to  security incidents, it had not always developed a complete and accurate inventory of systems that would  allow it to ensure that appropriate security controls had been applied; documented key controls in system security plans to inform officials  about the security risks involved in operating those systems;  conducted complete and effective security testing of its systems to  ensure that controls were implemented and operating as intended; developed remedial action plans for identified security weaknesses  and taken timely action to complete those it did develop; ensured that all systems had been appropriately reviewed and  authorized to operate, increasing the risk that officials may not be  aware of system security risks; ensured that all required users completed security awareness training; included appropriate security-related provisions in contracts for IT  products and services; and fully assessed risks to privacy arising from the use of selected  systems.
In addition to these program shortcomings, we also identified weaknesses  in the implementation of technical security controls for nine selected  systems. These included controls related to preventing unauthorized  access, authorization, configuration management, boundary protection,  patch management, and physical security. These weaknesses limited the  effectiveness of security controls and placed sensitive information at risk  of unauthorized disclosure, modification, or loss.
section_title: IT Services Were Not Supporting Organizational Needs
paragraphs: Recognized best practices call for ensuring that an organization’s IT  services are aligned with and support its business needs. These include  (1) developing a catalog of all current IT services delivered by the service  provider to its customers and (2) establishing service-level agreements  between the provider and customer to describe the services, specify the  responsibilities of both parties, and document expected levels of service.
As mentioned previously, at the time of our review, the Library’s office of  Information Technology Services (ITS) was the central IT organization in  the agency and was responsible for providing an array of IT services to  other units within the Library. To its credit, ITS developed a service  catalog that captured its current IT services, which included, for example,  service desks, backup and recovery, and network services. However, ITS  did not establish service-level agreements that covered all the services it  provided to other units, or establish targets for expected levels of service.  This increased the risk that the office would not provide services that  meet the needs of other units in the Library, and in turn that IT would not  effectively support the overall mission of the organization.
While ITS had undertaken some ad hoc efforts to improve the satisfaction  of users throughout the Library, they were largely unsuccessful and were  not guided by a documented plan that prioritized improvement projects  and identified needed resources, schedules, and measurable outcomes.
Reflecting these weaknesses, a survey we conducted of the various  service units showed that customers of the Library’s IT services were  generally not satisfied. Respondents cited a number of factors that  contributed to their dissatisfaction, including a lack of transparency, poor  service quality, inconsistent implementation of IT management  processes, inconsistent communication, and use of outdated technology.
This dissatisfaction, along with the lack of an enterprise-wide approach to  managing IT, had contributed to other units within the Library performing  duplicative or overlapping activities. For example:
Multiple service units maintained their own service desks.
Service units conducted their own IT human capital assessments.
Several units independently purchased similar IT assets, such as  desktop or laptop computers, network devices, and server and  desktop software.
One service unit purchased 82 24-inch computer monitors even  though ITS had already purchased 100 similar monitors.
Service units independently managed their servers, networks, and  websites.
Without more concerted efforts to improve the satisfaction of users of the  Library’s IT services, as well as reviewing the costs and benefits of  overlapping or duplicative activities, the agency lacked assurance that it  was cost-effectively using IT to support its mission.
section_title: A Lack of Strong Leadership Contributed to IT Management Weaknesses
paragraphs: As our research and experience at federal agencies have shown,  agencies need a CIO with responsibility for managing their IT and clearly  defined responsibilities between the CIO and officials responsible for IT  management at component organizations. In addition, we have reported  that CIOs and other former agency IT executives believed that it was  necessary for a CIO to stay in office for 3 to 5 years to be effective and 5  to 7 years to implement major change initiatives.
However, many of the IT management weaknesses we identified at the  Library stemmed from a lack of strong, sustained leadership. Specifically,  the agency’s CIO did not have adequate responsibility for the agency’s IT,  including authority over commodity IT and oversight of investments in  mission-specific systems made by the service units. In addition, five  different people had filled the CIO position temporarily since 2012. The  absence of strong, sustained leadership hampered the Library’s ability to  make needed improvements in the face of long-standing IT management  challenges.
Since our report was issued, the Library appointed a new permanent CIO  in September 2015, and this official heads a reorganized office that  reports to the newly appointed Chief Operating Officer.
section_title: Copyright Office Needs to Develop Plans for Addressing Long-Term IT Needs
paragraphs: In our March 2015 report on the Copyright Office, we noted that it had  been reacting to short-term needs, such as retiring legacy systems, but  needed to develop concrete plans and strategies for how IT would  support its mission and business needs in the longer term. The  Copyright Office’s mission requirements, including its use of IT, are driven  by its role as the administrator of the nation’s copyright law. Specifically,  the office is required by law to, among other things, receive and examine  copyright registration applications, collect and maintain deposited copies  of copyrighted works, produce certificates of registration and certified  copies of applications, and maintain records of the transfer of copyright  ownership.
These responsibilities drive the office’s use of IT to facilitate, for example,  the electronic registration of works, examination of copyright registrations,  and recording transfers of copyright. In particular, the Copyright Office  relies heavily on its eCO system to support the registration process. This  system provides a public interface for submitting applications as well as a  back-end system for Copyright staff to process these applications. While  the office relies on other legacy systems to support its recordation and  licensing functions, Copyright staff told us that the office plans to  consolidate functionality from all registration and recordation systems into  eCO.
However, eCO has had significant technical issues, both with the system  itself, which is managed by the Copyright Office, and its underlying  infrastructure managed by the Library. Both internal and external users  have highlighted challenges in using the system, as well as with the  office’s broader technical environment. These included the following:
Performance and usability: Both internal and external users  described challenges with eCO’s performance and usability. These  included the system freezing up multiple times daily and an interface  that requires users to enter the same data multiple times. In an online  survey by the office, one eCO user described the system as “hands  down, the worst site I have ever had to navigate.”
Security: Consistent with our findings across the Library, as of  February 2015, the Copyright Office did not have complete security  documentation for eCO, including complete security testing, a current  authorization to operate, and a privacy impact assessment.
Data integrity: Both the Copyright Office and the Library’s ITS had  identified issues with the integrity of data in the eCO system. For  example, eCO was not properly saving registration certificates, and  the office’s General Counsel stated that it does not have a means of  verifying the integrity of files maintained in its systems.
Data availability and retention: A service-level agreement had not  been established between the Copyright Office and ITS for the office’s  legal responsibility to retain unpublished works (including digital  works) for up to 120 years. Maintaining access to these files for that  long will require migration to new storage solutions as technology  evolves.
In addition to these technical challenges, the Copyright Office faced  organizational challenges related to the IT management weaknesses at  the Library (as highlighted in our report and discussed above). For  example, the lack of clearly defined roles and responsibilities among the  Library CIO and the service units had impeded the Copyright Office’s  ability to meet its IT needs. In addition, the office had been hindered in  developing its own IT strategic plan and other long-term plans due to the  absence of such plans for the Library as a whole. Further, inconsistent  service management had resulted in dissatisfaction at Copyright with IT  services provided by the Library, which led the office to pursue IT  activities on its own. As mentioned above, ITS did not always establish  levels of expected services it provides to other units in the Library, and  this has resulted in services that do not meet business needs. For  example, according to the Copyright Office CIO, ITS controls when eCO  is to be shut down for maintenance, and these scheduled outages had, at  times, occurred during periods of heavy traffic from the office’s external  users.
subsections: section_title: Copyright Office Had Not Developed Plans for Improving Its IT Environment
paragraphs: Although the Copyright Office acknowledged many of the organizational  and technical challenges we identified, it had not yet developed adequate  plans to improve its IT environment. Specifically, while the office had  identified several proposed initiatives for making improvements and  requested over $7 million to fund them, it had not developed plans and  proposals to justify those investments.
The office’s proposed improvement projects included the following:
Reengineering the recordation process from an IT, legal, and  administrative perspective and ultimately developing on online filing  system.
Developing a secure digital repository for works that are registered  and electronically deposited with the office for protection.
Creating a software development environment for future copyright- specific applications.
Developing a data strategy, plan, model, and standards for managing  the office’s records.
In addition, the office had researched needed technical upgrades to its  electronic registration process and identified four areas in greatest need  of improvement. These were (1) challenges with the current user  experience, (2) challenges with access to and usability of copyright  records, (3) inefficiencies with current copyright data, and (4) poor  performance of outdated IT architecture. The research also resulted in  proposed recommendations for improvements in these areas.
These activities notwithstanding, the Copyright Office did not develop  plans to justify and provide direction for its investments, as called for by  leading practices. Specifically, while the office developed funding  requests for its improvement projects, they did not include key information  such as 3-year cost estimates, the business needs driving the  investments, how the investments aligned with the agency’s strategic  plan, or expected funding sources.
We also reported that the Copyright Office had not developed an IT  strategic plan, including goals, measures, and timelines, to guide its IT  improvement efforts and monitor progress in meeting its goals. This effort  was hindered by the fact that the Library itself did not have an up-to-date  IT strategic plan, and we noted that developing such a plan, aligned with  the Library’s future efforts, would help ensure the office’s current and  future investments would support its mission needs and avoid duplication  with existing activities within the Library.
In October 2015, the Copyright Office released a draft overall strategic  plan for fiscal years 2016 through 2020. The plan included six strategic  goals and strategies to achieve those goals, including strategies involving  IT. For example, strategies for achieving the goal of build a robust and  flexible technology enterprise that is dedicated to the current and future  needs of a modern copyright agency included employing sound policies  for the acquisition and management of technology investments.  Furthermore, the strategic plan noted that the Copyright Office is  developing a detailed IT plan with the assistance of a consulting firm and  will seek public comments on specific strategies, costs, and timelines for  its technology objectives.
section_title: Implementing GAO’s Recommendations Is Crucial to Improving IT Management
paragraphs: In our reports we made a number of recommendations to the Library of  Congress and the Copyright Office aimed at improving the management  of their IT resources.
For the Library, we recommended that the Librarian take a number of  actions to address weaknesses in the six IT management areas, to  include the following:
Expeditiously hire a permanent CIO responsible for managing the  Library’s IT and ensure this official has clearly defined responsibilities  and adequate authority, including (1) responsibility for commodity IT,  (2) oversight of mission-specific systems, and (3) clearly defined  responsibilities and authorities between the Library CIO and service  unit IT leadership. This can help provide stable, consistent, and  effective leadership for addressing the weaknesses we identified and  improve the management of IT at the Library.
Complete an IT strategic plan that addresses key elements, develop a  complete and reliable enterprise architecture, and complete an  assessment of IT human capital needs.
Take steps to improve the Library’s investment management process,  including clarifying the responsibilities of the investment review board,  improving the investment selection process, improving the investment  oversight process, and ensuring complete and accurate data on IT  investments and assets.
Address weaknesses in the Library’s IT acquisition efforts by  establishing and implementing organization-wide policies for risk  management, requirements development, cost estimation, and  schedule estimation.
Take steps to address weaknesses identified in the Library’s  information security and privacy programs, including its systems  inventory, system security plans, security testing, remedial action  plans, authorization process, contingency planning, security  awareness training, contract management, and privacy impact  assessments.
Improve the management of IT services by ensuring that service-level  agreements appropriately cover all services and include service-level  targets, documenting and executing a plan for improving satisfaction  with IT services, and assessing the costs and benefits of consolidating  potentially duplicative or overlapping IT activities across the  organization.
In its comments on a draft of our report, the Library generally concurred  with our recommendations, described ongoing and planned actions to  address them, and provided milestones for completing these actions. For  example, the Library stated that by September 2015 it would complete a  skills assessment of IT staff throughout the Library, ensure its inventory of  IT assets is up to date, and require appropriate service-level agreements  between ITS and Library service units.
In November 2015, we discussed the implementation status of the  recommendations with the newly appointed Library CIO, and he stated  that the Library had taken steps toward addressing them. For example,  the CIO released an IT strategy for fiscal year 2016 to provide guidance  while the Library’s IT strategic plan is being developed. Additionally, the  CIO and Chief Financial Officer issued a memo requiring service units to  track IT spending in the Library’s financial accounting system. Further,  according to the acting Deputy CIO, the Library has completed an  inventory of its IT hardware.
These efforts notwithstanding, as of November 2015, the Library has yet  to fully implement any of our 31 recommendations, including those that  were to be completed by the end of fiscal year 2015. For example, while  the Library, consistent with our recommendation, hired a new permanent  CIO, it remains to be seen whether he will be provided with clear  responsibility and adequate authority for leading improvements in the  management of the Library’s IT. As it continues these efforts, it will be  important for the Library to commit to milestones for implementing our  recommendations and follow through on these commitments in order to  make progress in improving its IT management.
For the Copyright Office, we recommended that it develop (1) more  detailed plans for its proposed IT improvement initiatives and (2) an IT  strategic plan with prioritized IT goals, measures, and timelines to guide  its improvement efforts. In November 2015, Copyright officials provided  us with plans that had been developed for three IT improvement initiatives  proposed for funding in fiscal year 2017. These initiatives were for  software and hardware upgrades, searchable historic copyright records,  and a data management initiative. The plans for these three initiatives  included key elements such as a business problem and proposed  solution, expected benefits, alignment with the Library’s strategic plan,  and initial, 3-year cost estimates and funding sources. In addition, as  noted above, the office recently developed a draft overall strategic plan,  and it includes strategies to support the goal of improving the Copyright  IT environment. This is an important step that should help provide  direction for future IT initiatives.
In conclusion, effectively managing its IT resources is critical for the  Library to carry out its mission of preserving and making available the  knowledge and creative output of the American people, as well as  ensuring the smooth operations of the nation’s copyright system.  Widespread weaknesses in IT management at the Library raised serious  concerns about its ability to effectively carry out its responsibilities in a  21st century digital environment. In addition, dissatisfaction with services  and support provided by the Library’s central IT organization had led to  other service units pursing activities independently, potentially resulting in  overlapping or duplicative activities. Implementing our recommendations  will help ensure the Library is better positioned to effectively use  technology to support its mission. The Library’s recent appointment of a  permanent CIO is a positive development; ensuring that this official has  the appropriate authority and responsibilities is key to addressing the  many weaknesses we identified. For its part, the Copyright Office has  taken steps—such as developing a draft strategic plan and detailed plans  for new IT improvement initiatives—that can help lay the groundwork for a  proactive approach to modernizing its IT environment.
Chairman Miller, Ranking Member Brady, and Members of the  Committee, this concludes my prepared statement. I would be pleased to  answer any questions you may have at this time.
section_title: Contact and Acknowledgments
paragraphs: If you or your staffs have any questions about this statement, please  contact Joel C. Willemssen, Managing Director, Information Technology,  at (202) 512-6253 or willemssenj@gao.gov. Other staff who contributed  to this statement include Nick Marinos (assistant director), Torrey Hardee,  Thomas Johnson, Kaelin Kuhn, Lee McCracken, Kathleen Sharkey, and  Tina Torabi.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.