GSA audit finds 116 sensitive files shared beyond business need

A limited search of the General Services Administration’s Google Drive found 116 files containing controlled unclassified information (CUI) improperly shared with all GSA users, including contractors without a legitimate business need to know, the agency’s inspector general said in a report issued Oct. 27, 2026. The watchdog concluded that GSA was not effectively protecting information stored in Drive.

The files contained physical-security information, personally identifiable information and proprietary business material. Examples included building site and floor plans, Social Security numbers, dates of birth, phone numbers and addresses, as well as proprietary research and vendor proposals with technical and pricing details. FedScoop reported that more than half of the identified files contained physical-security information and five contained personally identifiable information. The report gives no aggregate count of affected people.

The finding concerns access within GSA’s Google Drive, not availability on the public internet. Separately, GSA Chief Information Officer David Shive told FedScoop that GSA IT’s review found the identified documents were not exposed externally. Shive said access reviews and user interviews found no indication of malicious intent. That account does not establish whether anyone viewed the files.

GSA management said 2.5 million documents were stored in Drive. The 116 identified files amount to roughly one in 21,600 documents in that reported total, or about 0.005%. That comparison gives a sense of scale, not an exposure rate: the inspector general described its search as limited, not a review of all 2.5 million documents, and did not determine the total number of exposed files.

Audit found gaps in search and access controls i

The audit identified weaknesses in GSA’s data-loss-prevention tool. Annual reviews of search terms were incomplete, relevant terms were missing, and searches failed to detect exposed documents, including some containing terms the tool already used. The tool could use optical character recognition, but that feature had not been implemented. GSA staff were unaware of a 15-megabyte file-size limit, and decisions about how the program operated were not documented.

The inspector general also found no approval process for certain sensitive information shared with all agency users and no standard naming convention for CUI files. Its seven recommendations include restricting access to the 116 files, searching for and restricting other exposed files, and identifying and notifying affected people under GSA’s breach-notification policy. Other recommendations address sharing approvals, file names, guidance and training, and stronger search and data-loss-prevention controls.

The GSA CIO agreed with the recommendations. FedScoop reported Shive’s statement that GSA took corrective actions during the audit, including policy and procedure updates. Oversight.gov lists all seven recommendations as open; the reported updates do not establish that every recommendation has been completed.

Watchdog concerns span more than a decade i

The inspector general says it first raised concerns about sensitive information in GSA’s Google environment in August 2014, issued additional reports from 2015 through 2017, and identified unauthorized CUI exposures again in April 2025. FedScoop reported that the audit reviewed GSA Drive from March through December 2025. The 2026 report does not establish that the 116 files were the same files involved in earlier matters.

The exposed site plans included plans for buildings in Washington, D.C.; the inspector general cited potential security risks to building occupants but did not establish that harm occurred.