	Background

Established in 1800, the Library of Congress is the world’s largest library  and serves as the research arm of Congress. Copyright Office. The U.S. At the time of our review, the Office of Strategic Initiatives was  responsible for the overall digital strategic planning for the Library and  included the office of Information Technology Services (ITS), which  was to support the Library’s IT systems and infrastructure. The Copyright Office also relies extensively on IT to carry out its mission. Weaknesses in IT Management across the Library Demonstrate the Need for Stronger Leadership

In March 2015, we reported that the Library had serious weaknesses in  the management of IT across the organization. Specifically, the Library’s  policies, procedures, and implementation in six IT management–related  areas had significant weaknesses. However, as we reported, the Library had not developed an IT strategic  plan that was aligned with the agency’s overall strategic plan and  included results-oriented goals and measures, strategies for achieving its  goals, and descriptions of how projects fit together to support these goals. Thus, the Library lacked a clear vision of what it wants  to accomplish with IT and strategies for achieving those results. Such a  strategic approach is essential to the Library as information is increasingly  created, shared, and preserved digitally. Consequently, the Library did not know  how much it spends on IT. These practices include, among others, risk  management, requirements development, cost estimating, and  scheduling. However, the Library had not fully implemented key elements of its  information security and privacy programs. For example, while the Library  did establish and implement a process for reporting and responding to  security incidents, it had not always developed a complete and accurate inventory of systems that would  allow it to ensure that appropriate security controls had been applied; documented key controls in system security plans to inform officials  about the security risks involved in operating those systems;  conducted complete and effective security testing of its systems to  ensure that controls were implemented and operating as intended; developed remedial action plans for identified security weaknesses  and taken timely action to complete those it did develop; ensured that all systems had been appropriately reviewed and  authorized to operate, increasing the risk that officials may not be  aware of system security risks; ensured that all required users completed security awareness training; included appropriate security-related provisions in contracts for IT  products and services; and fully assessed risks to privacy arising from the use of selected  systems. These weaknesses limited the  effectiveness of security controls and placed sensitive information at risk  of unauthorized disclosure, modification, or loss. Specifically,  the office is required by law to, among other things, receive and examine  copyright registration applications, collect and maintain deposited copies  of copyrighted works, produce certificates of registration and certified  copies of applications, and maintain records of the transfer of copyright  ownership. In particular, the Copyright Office  relies heavily on its eCO system to support the registration process. Data integrity: Both the Copyright Office and the Library’s ITS had  identified issues with the integrity of data in the eCO system. We also reported that the Copyright Office had not developed an IT  strategic plan, including goals, measures, and timelines, to guide its IT  improvement efforts and monitor progress in meeting its goals. This effort  was hindered by the fact that the Library itself did not have an up-to-date  IT strategic plan, and we noted that developing such a plan, aligned with  the Library’s future efforts, would help ensure the office’s current and  future investments would support its mission needs and avoid duplication  with existing activities within the Library. Implementing GAO’s Recommendations Is Crucial to Improving IT Management

In our reports we made a number of recommendations to the Library of  Congress and the Copyright Office aimed at improving the management  of their IT resources. For the Library, we recommended that the Librarian take a number of  actions to address weaknesses in the six IT management areas, to  include the following:
Expeditiously hire a permanent CIO responsible for managing the  Library’s IT and ensure this official has clearly defined responsibilities  and adequate authority, including (1) responsibility for commodity IT,  (2) oversight of mission-specific systems, and (3) clearly defined  responsibilities and authorities between the Library CIO and service  unit IT leadership. For example, while  the Library, consistent with our recommendation, hired a new permanent  CIO, it remains to be seen whether he will be provided with clear  responsibility and adequate authority for leading improvements in the  management of the Library’s IT. In conclusion, effectively managing its IT resources is critical for the  Library to carry out its mission of preserving and making available the  knowledge and creative output of the American people, as well as  ensuring the smooth operations of the nation’s copyright system. In addition, dissatisfaction with services  and support provided by the Library’s central IT organization had led to  other service units pursing activities independently, potentially resulting in  overlapping or duplicative activities. For its part, the Copyright Office has  taken steps—such as developing a draft strategic plan and detailed plans  for new IT improvement initiatives—that can help lay the groundwork for a  proactive approach to modernizing its IT environment.
Why GAO Did This Study

The Library of Congress is the oldest federal cultural institution and the world's largest library. Its mission is to preserve and make available works of creativity and human knowledge, and to serve as the research arm of the U.S. Congress. In addition, the Library houses the U.S. Copyright Office, which is charged with administering the nation's copyright law. As information is increasingly created, shared, and preserved digitally, both the Library and Copyright Office rely on IT to support their missions.
GAO was asked to provide a statement summarizing its March 2015 reports on the Library's IT management and the Copyright Office's IT environment and plans for modernization. In preparing this statement, GAO relied on the work supporting these reports. GAO also interviewed Library and Copyright officials about more recent activities to implement GAO recommendations.

What GAO Found

In a March 2015 report, GAO identified widespread weaknesses in the Library of Congress's management of its information technology (IT) resources. These weaknesses spanned six IT management–related areas:
Strategic planning: The Library had not developed an IT strategic plan that defined what it wants to accomplish with IT and strategies for achieving those results. Such a strategic approach is essential to the Library as information is increasingly created, shared, and preserved digitally.
Investment management: The Library had not effectively implemented processes for selecting or overseeing its investments in IT. In addition, it did not have an accurate inventory of its IT assets and did not know how much it was spending on IT.
Acquisition management: The Library had not fully implemented processes for ensuring that its IT acquisitions were guided by well-developed requirements, risk management practices, and reliable cost and schedule elements.
Information security: Weaknesses in its information security and privacy programs, as well as weaknesses in technical security controls, placed the Library's systems at risk of unauthorized access, modification, or loss.
Service management: The Library's central IT office did not provide services that satisfied the other units in the organization, leading to those units engaging in overlapping and duplicative activities and purchases.
Leadership: The Library's lack of a chief information officer with adequate authority and clear responsibility for managing the agency's IT was a key contributing factor to the weaknesses GAO identified.
Since GAO issued its report, the Library has taken actions toward addressing these weaknesses; however, much more remains to be done. For example, it appointed a new chief information officer, but it remains to be seen whether this official will have clear responsibility and adequate authority to drive needed improvements.
Regarding the Copyright Office, GAO reported in March 2015 that the office's IT environment was to support its duties of receiving and examining copyright registration applications, maintaining deposited copies of copyrighted works, producing certificates of registration, and maintaining records of the transfer of copyright ownership. However, the office faced a number of IT challenges, particularly with regard to its Electronic Copyright Office system, which supports the registration of copyrights. These challenges included user complaints about the performance and usability of the system, information security weaknesses, and data retention and integrity issues, among other things. The Copyright Office was also hindered by inadequate IT services and support from the Library.
While the office had proposed investments in several IT improvement projects, it had not developed an IT strategic plan to guide its efforts and monitor progress in meeting its goals. Since GAO's review, the Copyright Office has issued an overall draft strategic plan that, among other things, describes goals and strategies for improving its IT environment.

What GAO Recommends

In its March 2015 reports, GAO recommended that the Library of Congress take 31 actions to address weaknesses in six IT management–related areas and that the Copyright Office, among other things, develop an IT strategic plan. The Library concurred with GAO's recommendations, but it has yet to fully implement any of the 31 actions. GAO continues to believe that actions should be taken to fully implement these recommendations. For its part, the Copyright Office has taken steps to address GAO's recommendations, such as drafting a new strategic plan.