Specifically, strategic planning for IT was not  linked directly to the overall Library strategic plan and did not have a  “forward-looking” view; strategic planning was not linked to the IT  investment process; the organizational structure of the ITS directorate did  not foster strategic planning and good IT governance; areas of overlap  existed in support services and systems, including a number of service  units that maintained their own technology offices and help desk  functions; the Library was missing an enterprise architecture program,  which should be coupled with a strategy for implementing future  technology; and ITS customer service needed improvement, to include  the use of service-level agreements. The Library agreed with the recommendation. Congress has also recognized the Library’s IT management challenges. At the conclusion of our review in January 2015, the Library’s  Chief of Staff stated that the agency plans to draft a new IT strategic plan  within 90 days. These processes focus on the agency’s ability to select,  oversee, and review IT projects. The Library’s information  resource management policy also gives the ITSC responsibility for  formalizing the policies and procedures for selecting and managing IT  investments. Additionally, the Library’s investment management process is not fully  coordinated with its IT strategic plan and enterprise architecture. Consequently, the Library does not know how much it spends  In the absence of this information, we estimated that the Library obligated  at least $119 million on IT for fiscal year 2014. For example, the system lists over  18,000 “active” personal computers, even though, according to Library  officials, it actually has fewer than 6,500 personal computers in use. However, the Library has not developed policies in these areas that  address key practices. Specifically, while the Library did establish and implement a  process for handling security incidents, it did not (1) have a complete  inventory of its systems for purposes of monitoring security controls, (2)  fully outline security controls in system security plans, (3) conduct  complete security testing of its systems, (4) develop and complete in a  timely fashion plans for remediating identified security weaknesses, (5)  establish contingency plans for its systems, (6) fully document security  training policies or ensure that all users had taken required training, (7)  include security-related requirements in all applicable contracts for IT  services, or (8) fully assess risks to the privacy of personal information in  its systems. Until it addresses these  weaknesses, the Library’s systems and the information they contain will  be at increased risk of compromise. The Library has established and implemented an incident handling  process. Additionally, the Library did not always follow its policy. Additionally, the Library’s security testing did not always identify control  weaknesses. These three organizations also maintain separate e-mail  environments. However, the Library has not performed such  a review. However, the Library does not have the leadership needed to address the  IT management weaknesses identified in this report. Conclusions

As information is increasingly created, shared, and preserved digitally,  effectively managing its IT resources will be even more critical for the  Library to carry out its mission of preserving and making available the  knowledge and creative output of the American people. More basically, because the Library does not  have accurate data on what it spends on IT each year or an accurate  inventory of IT assets, it is limited in its ability to make informed  investment decisions or ensure that it does not waste money on IT. While, to its credit, the Library has established roles and  responsibilities and policies and procedures for information security and  privacy, significant weaknesses in implementing key security  management controls call into serious question whether the information  and systems at the Library are being adequately protected. While ITS—as the central IT organization within the Library—is  responsible for providing IT-related services to the Library’s other units,  the lack of satisfaction with these services has contributed to the other  units pursuing their own IT activities, potentially resulting in duplicative  investments and wasted resources. If it follows through on  plans to appoint such an official and invests the position with the  appropriate authority, the Library will be in a stronger position to address  the IT management challenges we have identified and make a more  effective and efficient use of technology to support its mission. Appendix I: Objectives, Scope, and Methodology

The House Appropriations Committee report accompanying the fiscal  year 2015 legislative branch appropriations bill required GAO to review  the Library of Congress’s management of information technology (IT). Our specific objectives for this review were to assess the extent to which  the Library of Congress (1) addressed in its strategic planning the IT and  related resources required to meet its goals and objectives; (2)  established an IT governance structure to manage the selection, control,  and evaluation of IT investments; (3) used IT acquisition and  development best practices; (4) established programs for ensuring the  information security and privacy protection of its information and  information systems; (5) used best practices for managing IT services;  and (6) has a chief information officer (CIO) with authority to exercise  control and oversight of IT management functions.
Why GAO Did This Study

The Library of Congress is the world's largest library, whose mission is to make its resources available and useful to Congress and the American public. In carrying out its mission, the Library increasingly relies on IT systems, particularly in light of the ways that digital technology has changed the way information is created, shared, and preserved.
The House Appropriations Committee report accompanying the 2015 legislative branch appropriations bill required GAO to conduct a review of IT management at the Library. GAO's objectives focused on the extent to which the Library has established and implemented key IT practices and requirements in, among other areas: (1) strategic planning, (2) governance and investment management, (3) information security and privacy, (4) service management, and (5) leadership. To carry out its work, GAO reviewed Library regulations, policies, procedures, plans, and other relevant documentation for each area and interviewed key Library officials.

What GAO Found

The Library of Congress has established policies and procedures for managing its information technology (IT) resources, but significant weaknesses across several areas have hindered their effectiveness:
Strategic planning: The Library does not have an IT strategic plan that is aligned with the overall agency strategic plan and establishes goals, measures, and strategies. This leaves the Library without a clear direction for its use of IT.
Investment management: Although the Library obligated at least $119 million on IT for fiscal year 2014, it is not effectively managing its investments. To its credit, the Library has established structures for managing IT investments—including a review board and a process for selecting investments. However, the board does not review all key investments, and its roles and responsibilities are not always clearly defined. Additionally, the Library does not have a complete process for tracking its IT spending or an accurate inventory of its assets. For example, while the inventory identifies over 18,000 computers currently in use, officials stated that the Library has fewer than 6,500. Until the Library addresses these weaknesses, its ability to make informed decisions will be impaired.
Information security and privacy: The Library assigned roles and responsibilities and developed policies and procedures for securing its information and systems. However, its implementation of key security and privacy management controls was uneven. For example, the Library's system inventory did not include all key systems. Additionally, the Library did not always fully define and test security controls for its systems, remediate weaknesses in a timely manner, and assess the risks to the privacy of personal information in its systems. Such deficiencies also contributed to weaknesses in technical security controls, putting the Library's systems and information at risk of compromise.
Service management: The Library's Information Technology Services (ITS) division is primarily responsible for providing IT services to the agency's operating units. While ITS has catalogued these services, it has not fully developed agreements with the other units specifying expected levels of performance. Further, the other units were often not satisfied with these services, which has contributed to them independently pursuing their own IT activities. This in turn has resulted in units purchasing unnecessary hardware and software, maintaining separate e-mail environments, and managing overlapping or duplicative IT activities.
Leadership: The Library does not have the leadership needed to address these IT management weaknesses. For example, the agency's chief information officer (CIO) position does not have adequate authority over or oversight of the Library's IT. Additionally, the Library has not had a permanent CIO since 2012 and has had five temporary CIOs in the interim.
In January 2015, at the conclusion of GAO's review, officials stated that that the Library plans to draft an IT strategic plan within 90 days and hire a permanent CIO. If it follows through on these plans, the Library will be in a stronger position to address its IT management weaknesses and more effectively support its mission.

What GAO Recommends

GAO is recommending that the Library expeditiously hire a permanent CIO. GAO is also making 30 other recommendations to the Library aimed at establishing and implementing key IT management practices. The Library generally agreed with GAO's recommendations and described planned and ongoing actions to address them.