Auditors have identified that the General Services Administration (GSA) has repeatedly allowed sensitive data to be accessible to staff and contractors without a proper business justification, according to a recent report from the agency’s Office of Inspector General.
The GSA, which manages various functions for federal agencies, such as contracting, property management, and procurement, has faced repeated findings since at least 2014 regarding insufficient safeguards for controlled unclassified information (CUI). CUI, within the context of the US federal government, refers to data that is not classified but mandates protection or usage restrictions under applicable regulations or government-wide mandates, meaning access should typically be restricted to individuals possessing a legitimate government need to know. The OIG report indicated that the GSA had left exposed various types of sensitive data, including proprietary business details, personally identifiable information (PII) belonging to government employees, and information related to the physical security of government facilities.
The report published this week states that approximately 2.5 million documents reside within the GSA’s Google Drive. Specifically, the report mentioned, “During a limited search of GSA’s Google Drive, we found 116 files containing CUI that were improperly shared with all GSA users.” This finding is based only on a limited review, and the OIG possesses significant grounds to suspect that additional unsecured data exists within the GSA’s Google Drive instance.
Furthermore, the OIG pointed out that the GSA is deficient in managing the third-party tool intended for preventing data loss and detecting CUI exposures. This inadequacy stems from incomplete or undocumented annual reviews of search terms, the failure to implement many pertinent search terms, and not activating an existing optical character recognition capability that could assist in detecting CUI within scanned documents. The GSA was also reportedly unaware of the tool’s 15 megabyte file size limitation, meaning that even with proper use of the tool, larger files would remain unchecked. The OIG further noted that the GSA is missing two key elements: "(1) an approval process for properly sharing sensitive information and (2) a standard naming convention that could more effectively prevent exposures of CUI in GSA’s Google Drive.”
The nature of the exposed data is concerning. The audit revealed that files containing site plans for Washington, DC buildings, were among the improperly controlled, including details on entry points, screening procedures, and the placement of sensitive zones such as gun lockers. Additionally, a progressive collapse analysis, which "describes the building’s collapse vulnerabilities, defense vulnerabilities, and critical failure locations,” was exposed. PII of government personnel was also compromised, encompassing addresses, dates of birth, social security numbers, and contact details. Proprietary business information was also revealed, specifically “including proprietary research and vendor proposals with technical and pricing information.” While this data might not have been public, this lapse in data control is alarming, particularly because contractors with access to the GSA’s Google Drive could potentially view proprietary data belonging to rival vendors, thereby gaining an unfair operational advantage.
This situation is not isolated; the GSA has previously been criticized by its own inspector general for substandard data protection practices. The OIG first identified these poor practices back in 2014. The OIG remarked, “In August 2014, we first reported that GSA did not protect sensitive information on child care centers, courthouses, water sources, building automation systems, and security and fire alarm systems in its Google cloud computing environment.” Moreover, the OIG issued supplemental reports between 2015 and 2017 highlighting concerns regarding the GSA's capacity to secure sensitive information within its Google environment. Another instance of improperly shared Google Drive files was flagged in April 2025. Although the GSA’s chief information officer concurred with the auditor’s seven recommendations for remediation, the report does not confirm whether these corrective actions have been finalized.
In response to the findings, a GSA spokesperson stated that “While the audit was underway, GSA IT confirmed their protective measures prevented the identified documents from external exposure," and added, "Immediately following, significant actions were taken to strengthen the protection of CUI across the agency’s Google Workspace. GSA IT is working to fully address the Inspector General’s recommendations.”
These recurring deficiencies in access governance and data lifecycle management underscore broader industry challenges concerning the secure operationalization of cloud platforms by large institutional bodies. The repeated identification of CUI exposures suggests systemic weaknesses in the implementation and oversight of security controls within the GSA’s infrastructure.
Why it matters
For infrastructure and security readers, this highlights significant platform control failures within a major federal agency. The exposure of site plans, PII, and vendor proposals raises serious questions about data governance and third-party tool management at scale. Readers should watch for how the GSA implements the seven recommendations to prevent recurrence.
