Information Technology: Library of Congress Needs to Implement Recommendations to Address Management Weaknesses
Released: 2015-12-02T00:00:00

Letter

Background

Established in 1800, the Library of Congress is the world’s largest library and serves as the research arm of Congress. Its collections include more than 36 million books and other print materials, 3.5 million recordings, 13.7 million photographs, 5.5 million maps, 6.7 million pieces of sheet music, and 69 million manuscripts. The items in its collection are received through a variety of sources, including through the copyright registration process administered by the U.S. Copyright Office.

Positioned within the legislative branch, the Library carries out its operations through a number of service and support units:

The Office of the Librarian had overall management responsibility for the Library and carried out certain executive functions.

The Congressional Research Service (CRS) is responsible for providing Congress with nonpartisan legislative research and analysis.

The U.S. Copyright Office is responsible for administering the Copyright Act, including copyright registration, recordation, mandatory deposit, and certain statutory licenses.

The Law Library provides Congress with ready access to reliable legal materials.

Library Services develops and preserves the Library’s collections and also included the National Library Service for the Blind and Physically Handicapped (NLS), which directs the production of books and magazines in Braille and recorded formats.

At the time of our review, the Office of Strategic Initiatives was responsible for the overall digital strategic planning for the Library and included the office of Information Technology Services (ITS), which was to support the Library’s IT systems and infrastructure. The head of the Office of Strategic Initiatives also served as the agency’s Chief Information Officer.

The Office of Support Operations was to provide essential infrastructure services to the entire Library.

IT Environment at the Library and Copyright Office

Like other federal agencies, the Library relies on a host of IT systems to carry out its mission. These include standard hardware (e.g., desktop and laptop computers, printers, and servers) and software (e.g., e-mail, word processing and spreadsheet programs, and Internet resources), as well as administrative and business systems, such as accounting, financial planning and budgeting, and human resources systems.

In addition, the Library’s service units use systems that support their specific missions. For example, NLS uses a system to manage the production, distribution, and maintenance of audiobooks, and CRS uses specialized software to develop its reports.

At the time of our review, much of the responsibility for managing the Library’s IT rested with the Office of Strategic Initiatives. More specifically, ITS, a component of the office, was responsible for supporting the other service units by planning, designing, developing, and maintaining systems and their supporting infrastructure.

As of September 2014, the Library had at least 380 staff across the various service units dedicated to IT functions. In addition, it obligated at least $119 million for IT during fiscal year 2014, with about $46 million for staff salaries and $73 million for goods and services, among other things. The Office of Strategic Initiatives accounted for about $72 million of the total IT obligations across the agency, with the rest allocated to the other service units, who also make their own investments in IT.

The Copyright Office also relies extensively on IT to carry out its mission. It uses multiple systems to support its registration, recordation, and licensing functions. In particular, the office’s Electronic Copyright Office (eCO) system is used by members of the public (e.g., authors) to register claims to a copyright and by Copyright Office staff to manage this process.

Weaknesses in IT Management across the Library Demonstrate the Need for Stronger Leadership

In March 2015, we reported that the Library had serious weaknesses in the management of IT across the organization. Specifically, the Library’s policies, procedures, and implementation in six IT management–related areas had significant weaknesses. These six areas were (1) strategic planning, (2) investment management, (3) acquisition, (4) information security and privacy, (5) service management, and (6) leadership of the Chief Information Officer (CIO) and other key officials.

Library Lacked Tools for Effective IT Strategic Planning

Strategic planning is essential for an organization to define what it seeks to accomplish, identify strategies to efficiently achieve results, and guide its efforts. For IT, key elements are an IT strategic plan and an enterprise architecture that, together, outline the agency’s IT goals, measures, and timelines. In addition, effective human capital management is critical to ensuring that an organization’s IT workforce has the necessary skills to support its goals.

However, as we reported, the Library had not developed an IT strategic plan that was aligned with the agency’s overall strategic plan and included results-oriented goals and measures, strategies for achieving its goals, and descriptions of how projects fit together to support these goals. Specifically, the Library had drafted an IT strategic plan that addressed some, but not all, of these elements, but at the time of our review it had not been finalized. Thus, the Library lacked a clear vision of what it wants to accomplish with IT and strategies for achieving those results. Such a strategic approach is essential to the Library as information is increasingly created, shared, and preserved digitally.

Regarding enterprise architecture, the Library had developed an architecture that described the current state of the Library’s IT systems and operations; however, the data supporting this effort were not gathered from management and validated by stakeholders, calling into question its reliability. Moreover, the architecture did not reflect the target state of the agency’s IT, the gaps between the current and target states, and specific steps the Library should take to move toward the target state.

The Library also fell short in its approach to IT human capital management. Specifically, it had not assessed the gaps between the current skills of its workforce and those that would be needed in the future, and developed strategies to fill those gaps. While individual service units had undertaken their own skills gap analyses, the Library lacked an organization-wide perspective that would allow it to take a strategic approach to ensuring an adequate IT workforce.

Selection and Oversight of Investments Was Not Effective

Recognized practices for managing the selection and oversight of IT investments, such as those outlined in our IT investment management framework, are critical to ensuring that an organization is prudently investing in the right mix of projects to support its mission. These practices include (1) instituting a board for making investment decisions, (2) selecting investments that meet business needs, (3) providing investment oversight, and (4) capturing accurate and comprehensive information on those investments and other IT assets.

The Library had instituted an investment review board and established elements of a process for selecting investments; however, these were not always effective. Specifically, Library policy did not clearly define the responsibilities of its investment board by, for example, specifying when investment decisions should be made by the board and when they should be elevated to the Library’s Executive Committee. Further, since the Library did not have a fully developed IT strategic plan or enterprise architecture, its investment management process was not fully coordinated with these processes, limiting the agency’s ability to make investment decisions that effectively support its mission and goals.

In addition, while the Library had developed a process for selecting investments for funding based on a balancing of risk factors and program benefits, it lacked policies or procedures for “re-selecting” investments for continued funding once they were operational. This is significant because operational investments accounted for the majority of the Library’s IT spending. Moreover, the Library had not integrated its investment selection and funding processes, meaning that decisions to fund projects were not informed by the evaluation of their relative risks and benefits. In some cases, individual service units secured funding for investments before bringing them to the investment review board—or the investments were not reviewed by the board at all.

Regarding investment oversight, the Library conducted assessments of investments’ progress through reviews of variations from planned cost and schedule baselines and the management of risk, among other things. However, for three selected investments we reviewed, cost, schedule, and risk data were not always complete or reliable. This limited the Library’s awareness of potential problems and its ability to take corrective action.

Further, the Library had not fully accounted for its IT-related expenditures but only collected that information for the subset of investments reviewed by the investment review board. Consequently, the Library did not know how much it spends on IT.

Similarly, the Library’s primary inventory of IT assets (e.g., hardware such as personal computers) was highly inaccurate. For example, the inventory listed over 18,000 active personal computers, even though officials told us that fewer than 6,500 personal computers were actually in use. Also, the Library had conflicting inventories of information systems, which disagreed on the number of systems in the agency. Specifically, Library officials provided us with two lists of systems, one with 30 systems and one with 46. After we raised this discrepancy, we were provided with a revised list of 70 systems. In the absence of an accurate inventory, the Library may be unable to effectively prevent loss or theft of assets, and it may end up purchasing equipment that is duplicative of what it already has on hand.

Key Acquisition Practices Were Not Followed

Proper implementation of key IT acquisition practices can significantly increase the likelihood of delivering promised system capabilities on time and within budget. These practices include, among others, risk management, requirements development, cost estimating, and scheduling.

However, the Library had not developed organization-wide policies in any of these areas that fully address key practices. Partly as a result, these practices were not fully implemented for selected investments we reviewed. For example:

Selected IT investments did not take such risk management measures as establishing a risk management strategy; evaluating, categorizing, and prioritizing risks; and developing risk mitigation strategies.

Investments did not effectively manage requirements by eliciting stakeholder needs and prioritizing customer requirements.

Cost estimates for selected investments did not sufficiently account for all costs, which is a foundational requirement for a reliable cost estimate.

Schedules for the selected investments were not fully reliable because they did not logically sequence planned activities to provide straightforward paths of critical activities.

Without establishing and implementing these key acquisition practices, investments may incur cost overruns and schedule slippages and fail to deliver capabilities needed to support the Library’s mission.

Security and Privacy Weaknesses Threatened Library Information and Systems

Protecting its data and information systems is essential both to defend an agency’s assets against cyber attacks and to protect sensitive information entrusted to it by the public. To do this, agencies should establish information security and privacy programs and effectively implement technical security and privacy controls, such as those outlined by the National Institute of Standards and Technology (NIST).

Consistent with NIST guidance, the Library had established security and privacy programs by delineating roles and responsibilities and developing policies and procedures. For example, it assigned security-related roles to appropriate officials, including the Librarian, Deputy Librarian, CIO, and Chief Information Security Officer. The Library also documented information security policies and procedures to safeguard its information and systems. Similarly, the Library developed policies to protect the privacy of data processed by its systems and designated the General Counsel as the agency’s Chief Privacy Officer, with responsibility for managing the protection of personally identifiable information maintained by Library systems.

However, the Library had not fully implemented key elements of its information security and privacy programs. For example, while the Library did establish and implement a process for reporting and responding to security incidents, it had not always developed a complete and accurate inventory of systems that would allow it to ensure that appropriate security controls had been applied; documented key controls in system security plans to inform officials about the security risks involved in operating those systems; conducted complete and effective security testing of its systems to ensure that controls were implemented and operating as intended; developed remedial action plans for identified security weaknesses and taken timely action to complete those it did develop; ensured that all systems had been appropriately reviewed and authorized to operate, increasing the risk that officials may not be aware of system security risks; ensured that all required users completed security awareness training; included appropriate security-related provisions in contracts for IT products and services; and fully assessed risks to privacy arising from the use of selected systems.

In addition to these program shortcomings, we also identified weaknesses in the implementation of technical security controls for nine selected systems. These included controls related to preventing unauthorized access, authorization, configuration management, boundary protection, patch management, and physical security. These weaknesses limited the effectiveness of security controls and placed sensitive information at risk of unauthorized disclosure, modification, or loss.

IT Services Were Not Supporting Organizational Needs

Recognized best practices call for ensuring that an organization’s IT services are aligned with and support its business needs. These include (1) developing a catalog of all current IT services delivered by the service provider to its customers and (2) establishing service-level agreements between the provider and customer to describe the services, specify the responsibilities of both parties, and document expected levels of service.

As mentioned previously, at the time of our review, the Library’s office of Information Technology Services (ITS) was the central IT organization in the agency and was responsible for providing an array of IT services to other units within the Library. To its credit, ITS developed a service catalog that captured its current IT services, which included, for example, service desks, backup and recovery, and network services. However, ITS did not establish service-level agreements that covered all the services it provided to other units, or establish targets for expected levels of service. This increased the risk that the office would not provide services that meet the needs of other units in the Library, and in turn that IT would not effectively support the overall mission of the organization.

While ITS had undertaken some ad hoc efforts to improve the satisfaction of users throughout the Library, they were largely unsuccessful and were not guided by a documented plan that prioritized improvement projects and identified needed resources, schedules, and measurable outcomes.

Reflecting these weaknesses, a survey we conducted of the various service units showed that customers of the Library’s IT services were generally not satisfied. Respondents cited a number of factors that contributed to their dissatisfaction, including a lack of transparency, poor service quality, inconsistent implementation of IT management processes, inconsistent communication, and use of outdated technology.

This dissatisfaction, along with the lack of an enterprise-wide approach to managing IT, had contributed to other units within the Library performing duplicative or overlapping activities. For example:

Multiple service units maintained their own service desks.

Service units conducted their own IT human capital assessments.

Several units independently purchased similar IT assets, such as desktop or laptop computers, network devices, and server and desktop software.

One service unit purchased 82 24-inch computer monitors even though ITS had already purchased 100 similar monitors.

Service units independently managed their servers, networks, and websites.

Without more concerted efforts to improve the satisfaction of users of the Library’s IT services, as well as reviewing the costs and benefits of overlapping or duplicative activities, the agency lacked assurance that it was cost-effectively using IT to support its mission.

A Lack of Strong Leadership Contributed to IT Management Weaknesses

As our research and experience at federal agencies have shown, agencies need a CIO with responsibility for managing their IT and clearly defined responsibilities between the CIO and officials responsible for IT management at component organizations. In addition, we have reported that CIOs and other former agency IT executives believed that it was necessary for a CIO to stay in office for 3 to 5 years to be effective and 5 to 7 years to implement major change initiatives.

However, many of the IT management weaknesses we identified at the Library stemmed from a lack of strong, sustained leadership. Specifically, the agency’s CIO did not have adequate responsibility for the agency’s IT, including authority over commodity IT and oversight of investments in mission-specific systems made by the service units. In addition, five different people had filled the CIO position temporarily since 2012. The absence of strong, sustained leadership hampered the Library’s ability to make needed improvements in the face of long-standing IT management challenges.

Since our report was issued, the Library appointed a new permanent CIO in September 2015, and this official heads a reorganized office that reports to the newly appointed Chief Operating Officer.

Copyright Office Needs to Develop Plans for Addressing Long-Term IT Needs

In our March 2015 report on the Copyright Office, we noted that it had been reacting to short-term needs, such as retiring legacy systems, but needed to develop concrete plans and strategies for how IT would support its mission and business needs in the longer term. The Copyright Office’s mission requirements, including its use of IT, are driven by its role as the administrator of the nation’s copyright law. Specifically, the office is required by law to, among other things, receive and examine copyright registration applications, collect and maintain deposited copies of copyrighted works, produce certificates of registration and certified copies of applications, and maintain records of the transfer of copyright ownership.

These responsibilities drive the office’s use of IT to facilitate, for example, the electronic registration of works, examination of copyright registrations, and recording transfers of copyright. In particular, the Copyright Office relies heavily on its eCO system to support the registration process. This system provides a public interface for submitting applications as well as a back-end system for Copyright staff to process these applications. While the office relies on other legacy systems to support its recordation and licensing functions, Copyright staff told us that the office plans to consolidate functionality from all registration and recordation systems into eCO.

However, eCO has had significant technical issues, both with the system itself, which is managed by the Copyright Office, and its underlying infrastructure managed by the Library. Both internal and external users have highlighted challenges in using the system, as well as with the office’s broader technical environment. These included the following:

Performance and usability: Both internal and external users described challenges with eCO’s performance and usability. These included the system freezing up multiple times daily and an interface that requires users to enter the same data multiple times. In an online survey by the office, one eCO user described the system as “hands down, the worst site I have ever had to navigate.”

Security: Consistent with our findings across the Library, as of February 2015, the Copyright Office did not have complete security documentation for eCO, including complete security testing, a current authorization to operate, and a privacy impact assessment.

Data integrity: Both the Copyright Office and the Library’s ITS had identified issues with the integrity of data in the eCO system. For example, eCO was not properly saving registration certificates, and the office’s General Counsel stated that it does not have a means of verifying the integrity of files maintained in its systems.

Data availability and retention: A service-level agreement had not been established between the Copyright Office and ITS for the office’s legal responsibility to retain unpublished works (including digital works) for up to 120 years. Maintaining access to these files for that long will require migration to new storage solutions as technology evolves.

In addition to these technical challenges, the Copyright Office faced organizational challenges related to the IT management weaknesses at the Library (as highlighted in our report and discussed above). For example, the lack of clearly defined roles and responsibilities among the Library CIO and the service units had impeded the Copyright Office’s ability to meet its IT needs. In addition, the office had been hindered in developing its own IT strategic plan and other long-term plans due to the absence of such plans for the Library as a whole. Further, inconsistent service management had resulted in dissatisfaction at Copyright with IT services provided by the Library, which led the office to pursue IT activities on its own. As mentioned above, ITS did not always establish levels of expected services it provides to other units in the Library, and this has resulted in services that do not meet business needs. For example, according to the Copyright Office CIO, ITS controls when eCO is to be shut down for maintenance, and these scheduled outages had, at times, occurred during periods of heavy traffic from the office’s external users.

Copyright Office Had Not Developed Plans for Improving Its IT Environment

Although the Copyright Office acknowledged many of the organizational and technical challenges we identified, it had not yet developed adequate plans to improve its IT environment. Specifically, while the office had identified several proposed initiatives for making improvements and requested over $7 million to fund them, it had not developed plans and proposals to justify those investments.

The office’s proposed improvement projects included the following:

Reengineering the recordation process from an IT, legal, and administrative perspective and ultimately developing on online filing system.

Developing a secure digital repository for works that are registered and electronically deposited with the office for protection.

Creating a software development environment for future copyright- specific applications.

Developing a data strategy, plan, model, and standards for managing the office’s records.

In addition, the office had researched needed technical upgrades to its electronic registration process and identified four areas in greatest need of improvement. These were (1) challenges with the current user experience, (2) challenges with access to and usability of copyright records, (3) inefficiencies with current copyright data, and (4) poor performance of outdated IT architecture. The research also resulted in proposed recommendations for improvements in these areas.

These activities notwithstanding, the Copyright Office did not develop plans to justify and provide direction for its investments, as called for by leading practices. Specifically, while the office developed funding requests for its improvement projects, they did not include key information such as 3-year cost estimates, the business needs driving the investments, how the investments aligned with the agency’s strategic plan, or expected funding sources.

We also reported that the Copyright Office had not developed an IT strategic plan, including goals, measures, and timelines, to guide its IT improvement efforts and monitor progress in meeting its goals. This effort was hindered by the fact that the Library itself did not have an up-to-date IT strategic plan, and we noted that developing such a plan, aligned with the Library’s future efforts, would help ensure the office’s current and future investments would support its mission needs and avoid duplication with existing activities within the Library.

In October 2015, the Copyright Office released a draft overall strategic plan for fiscal years 2016 through 2020. The plan included six strategic goals and strategies to achieve those goals, including strategies involving IT. For example, strategies for achieving the goal of build a robust and flexible technology enterprise that is dedicated to the current and future needs of a modern copyright agency included employing sound policies for the acquisition and management of technology investments. Furthermore, the strategic plan noted that the Copyright Office is developing a detailed IT plan with the assistance of a consulting firm and will seek public comments on specific strategies, costs, and timelines for its technology objectives.

Implementing GAO’s Recommendations Is Crucial to Improving IT Management

In our reports we made a number of recommendations to the Library of Congress and the Copyright Office aimed at improving the management of their IT resources.

For the Library, we recommended that the Librarian take a number of actions to address weaknesses in the six IT management areas, to include the following:

Expeditiously hire a permanent CIO responsible for managing the Library’s IT and ensure this official has clearly defined responsibilities and adequate authority, including (1) responsibility for commodity IT, (2) oversight of mission-specific systems, and (3) clearly defined responsibilities and authorities between the Library CIO and service unit IT leadership. This can help provide stable, consistent, and effective leadership for addressing the weaknesses we identified and improve the management of IT at the Library.

Complete an IT strategic plan that addresses key elements, develop a complete and reliable enterprise architecture, and complete an assessment of IT human capital needs.

Take steps to improve the Library’s investment management process, including clarifying the responsibilities of the investment review board, improving the investment selection process, improving the investment oversight process, and ensuring complete and accurate data on IT investments and assets.

Address weaknesses in the Library’s IT acquisition efforts by establishing and implementing organization-wide policies for risk management, requirements development, cost estimation, and schedule estimation.

Take steps to address weaknesses identified in the Library’s information security and privacy programs, including its systems inventory, system security plans, security testing, remedial action plans, authorization process, contingency planning, security awareness training, contract management, and privacy impact assessments.

Improve the management of IT services by ensuring that service-level agreements appropriately cover all services and include service-level targets, documenting and executing a plan for improving satisfaction with IT services, and assessing the costs and benefits of consolidating potentially duplicative or overlapping IT activities across the organization.

In its comments on a draft of our report, the Library generally concurred with our recommendations, described ongoing and planned actions to address them, and provided milestones for completing these actions. For example, the Library stated that by September 2015 it would complete a skills assessment of IT staff throughout the Library, ensure its inventory of IT assets is up to date, and require appropriate service-level agreements between ITS and Library service units.

In November 2015, we discussed the implementation status of the recommendations with the newly appointed Library CIO, and he stated that the Library had taken steps toward addressing them. For example, the CIO released an IT strategy for fiscal year 2016 to provide guidance while the Library’s IT strategic plan is being developed. Additionally, the CIO and Chief Financial Officer issued a memo requiring service units to track IT spending in the Library’s financial accounting system. Further, according to the acting Deputy CIO, the Library has completed an inventory of its IT hardware.

These efforts notwithstanding, as of November 2015, the Library has yet to fully implement any of our 31 recommendations, including those that were to be completed by the end of fiscal year 2015. For example, while the Library, consistent with our recommendation, hired a new permanent CIO, it remains to be seen whether he will be provided with clear responsibility and adequate authority for leading improvements in the management of the Library’s IT. As it continues these efforts, it will be important for the Library to commit to milestones for implementing our recommendations and follow through on these commitments in order to make progress in improving its IT management.

For the Copyright Office, we recommended that it develop (1) more detailed plans for its proposed IT improvement initiatives and (2) an IT strategic plan with prioritized IT goals, measures, and timelines to guide its improvement efforts. In November 2015, Copyright officials provided us with plans that had been developed for three IT improvement initiatives proposed for funding in fiscal year 2017. These initiatives were for software and hardware upgrades, searchable historic copyright records, and a data management initiative. The plans for these three initiatives included key elements such as a business problem and proposed solution, expected benefits, alignment with the Library’s strategic plan, and initial, 3-year cost estimates and funding sources. In addition, as noted above, the office recently developed a draft overall strategic plan, and it includes strategies to support the goal of improving the Copyright IT environment. This is an important step that should help provide direction for future IT initiatives.

In conclusion, effectively managing its IT resources is critical for the Library to carry out its mission of preserving and making available the knowledge and creative output of the American people, as well as ensuring the smooth operations of the nation’s copyright system. Widespread weaknesses in IT management at the Library raised serious concerns about its ability to effectively carry out its responsibilities in a 21st century digital environment. In addition, dissatisfaction with services and support provided by the Library’s central IT organization had led to other service units pursing activities independently, potentially resulting in overlapping or duplicative activities. Implementing our recommendations will help ensure the Library is better positioned to effectively use technology to support its mission. The Library’s recent appointment of a permanent CIO is a positive development; ensuring that this official has the appropriate authority and responsibilities is key to addressing the many weaknesses we identified. For its part, the Copyright Office has taken steps—such as developing a draft strategic plan and detailed plans for new IT improvement initiatives—that can help lay the groundwork for a proactive approach to modernizing its IT environment.

Chairman Miller, Ranking Member Brady, and Members of the Committee, this concludes my prepared statement. I would be pleased to answer any questions you may have at this time.

Contact and Acknowledgments

If you or your staffs have any questions about this statement, please contact Joel C. Willemssen, Managing Director, Information Technology, at (202) 512-6253 or willemssenj@gao.gov. Other staff who contributed to this statement include Nick Marinos (assistant director), Torrey Hardee, Thomas Johnson, Kaelin Kuhn, Lee McCracken, Kathleen Sharkey, and Tina Torabi.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.