GSA Audit Finds 116 CUI Files Overexposed in Google Drive

A General Services Administration Office of Inspector General audit found that GSA did not effectively protect controlled unclassified information (CUI) stored in its Google Drive environment. In a limited review conducted from March through December 2025, auditors identified 116 files shared agency-wide with employees and contractors who lacked a legitimate business need to access them. GSA management estimated that about 2.5 million documents were stored in the agency’s Google Drive, making the audit’s findings relevant to the broader challenge of applying consistent access controls across large collaboration environments. The files included personally identifiable information, proprietary business material, vendor proposals and pricing, proprietary research, and physical-security information such as site and floor plans showing building vulnerabilities and security areas.

The audit described weaknesses in both technology management and governance. More than half of the identified files contained physical-security information, while five contained PII, including Social Security numbers, dates of birth, phone numbers, and addresses. Auditors said GSA’s third-party data-loss-prevention tool did not reliably detect exposed CUI, and that GSA had not fully completed annual reviews of the tool’s search terms from 2015 through 2024. The tool reportedly had a 15-megabyte file-size limit, did not detect some documents even when search terms were present, and had not incorporated many relevant terms from agency guidance. About a third of the identified files contained “for official use only” or a similar phrase that the tool missed. GSA had spent $7.8 million on the tool as of September, according to the report; GSA CIO David Shive identified the tool as Cloudlock.

The OIG also found that GSA lacked standard naming conventions and an approval process for sharing sensitive information, had not documented some program decisions affecting CUI protection, and had not implemented an optical character recognition feature that could help identify sensitive content in scanned documents. The office issued seven recommendations, including restricting access to the identified files, searching for other improperly shared documents, and improving oversight and management of the data-loss-prevention tool. Shive concurred. He said, “While this audit was underway, GSA IT took significant corrective actions to strengthen the protection of sensitive information across GSA’s Google Workspace.” GSA stated that its review found the identified documents were not exposed externally and found no indication of malicious intent.

For GovCon teams, the report is a security and oversight signal rather than a confirmed procurement opportunity: GSA has not announced a solicitation or new contract. Contractors handling agency information should review CUI access permissions, need-to-know controls, document-sharing workflows, naming conventions, and data-loss-prevention practices. Companies pursuing or performing cloud collaboration, managed security, records management, and CUI discovery work can use the findings to anticipate agency scrutiny of configuration, tool maintenance, auditability, file-size coverage, and content inspection. A separate Department of Homeland Security incident reported in the source coverage involved a release of records identifying more than 41,000 employees and contractors. The incidents are distinct, but together underscore the operational consequences of weak information governance and the importance of validating both internal access controls and protection of personnel data.

• The GSA OIG identified 116 CUI files accessible to agency employees and contractors without a legitimate need to know.
• Exposed material included PII, vendor proposals and pricing, proprietary research, building-security details, and site or floor plans.
• More than half of the files contained physical-security information; five files contained PII, including Social Security numbers and contact details.
• GSA estimated about 2.5 million documents were stored in Google Drive; the audit reviewed the environment from March through December 2025.
• The data-loss-prevention tool had a 15-megabyte limit, missed some documents containing search terms, and did not catch “for official use only” variants in about a third of identified files.
• GSA had spent $7.8 million on the tool as of September; auditors cited incomplete annual search-term reviews spanning 2015–2024 and gaps in tool oversight.
• The OIG issued seven recommendations. GSA agreed and reported corrective actions, including tighter sharing controls and optical character recognition; the audit also called for finding other exposed files and improving tool management.
• GSA said the documents were not exposed externally and that its review found no indication of malicious intent. CIO David Shive said GSA IT took significant corrective actions during the audit.
• No solicitation or new contract was announced. Contractors should assess CUI permissions, need-to-know practices, document governance, scanning coverage, and data-loss-prevention controls.
• Separate reporting described a DHS records release identifying more than 41,000 employees and contractors; it is a distinct incident that reinforces the importance of personnel-data and operational-security safeguards.