GSA Inspector General: 116 Files With CUI, Including SSNs and Building Security Plans, Were Shared With Every GSA User

Nobody had to break into the General Services Administration to see the files. They were already shared with everyone in the building.

An audit from GSA's Office of Inspector General (OIG), released Tuesday, Oct. 27, found 116 files containing controlled unclassified information (CUI) in the agency's Google Drive that were shared with all GSA users. That means any employee or contractor with a GSA account could open them, whether or not they had a need to know. The auditors say they found the 116 files in a limited search. The Drive holds about 2.5 million documents.

This was an internal over-sharing problem, not a confirmed outside breach. GSA told The Register that "protective measures prevented the identified documents from external exposure," and that it has taken steps to strengthen protection of CUI across its Google Workspace. The watchdog's point is a different one. Inside a large agency with a big contractor workforce, "everyone at GSA" is a very large audience, and some of these documents were never meant for one.

What was in the files?

CUI is the federal government's label for information that isn't classified but that law, regulation or policy still says must be protected and shared only with people who need it. The OIG's examples show why the category exists.

According to the OIG's summary, the exposed material included:

Physical security details for federal buildings. These included Washington, D.C. site plans showing entrances, badge routes and screening techniques, a progressive collapse analysis (an engineering study of how a structure would fail if key supports were lost), and floor plans showing the locations of gun lockers, judges' chambers and jury rooms.
Personally identifiable information (PII). Social Security numbers, dates of birth, phone numbers and addresses.
Business-sensitive material. Proprietary research and vendor proposals that included pricing.

FedScoop, reporting on the audit, said more than half of the 116 files held physical security information and five contained PII. Building access routes and screening methods are exactly what someone planning to get past a federal checkpoint would want. Vendor pricing is exactly what a competing bidder would want. Neither should be readable by every account holder in the agency.

Didn't GSA have a tool for this?

It did. That is the uncomfortable part of the report.

GSA uses a data loss prevention (DLP) tool, meaning software that scans stored files for sensitive patterns and flags or blocks risky sharing. FedScoop reports that CIO David Shive referred to it as Cloudlock and that it had cost $7.8 million as of September. The OIG found it was not managed well enough to do its job:

Search terms weren't kept current. A DLP tool only finds what it is told to look for. The OIG found the annual review of the tool's search terms was incomplete, and FedScoop reports there were no records of those reviews for five of the years from 2015 to 2024.
No OCR. Optical character recognition, the feature that reads text inside scanned documents and images, was not turned on. Without it, a text scanner can miss content in scanned or image-based documents.
A file-size blind spot. The tool only handles files up to 15 MB, and the OIG found GSA was not aware of that limit. Files larger than that could be skipped by the scanner.
Markings went unnoticed. FedScoop says about a third of the files carried "for official use only" markings that the tool did not catch.

Apart from the tool, the OIG found two process gaps. GSA had no approval process for sharing files broadly and no naming convention that would make sensitive files easy to identify. Taken together, the findings describe a control that existed on paper and had expensive software behind it, but had drifted out of tune with the data it was meant to protect.

Is this new?

No. The OIG says it has reported on the problem before, in 2014, again in work covering 2015 through 2017, and in April 2025. Nextgov/FCW noted that the watchdog found similar CUI exposure at GSA back in 2014. The finding has come back after about twelve years.

The Register reports that the CIO agreed with all seven of the OIG's recommendations, but that the report does not show the fixes as completed.

What did the OIG recommend?

According to the OIG, the recommendations come down to three things:

Restrict access to the improperly shared files.
Notify affected individuals under GSA's breach policy. The OIG ties this to GSA's Information Breach Notification Policy.
Add controls that address the root causes: DLP tuning, a sharing-approval process and file naming conventions.

What It Means for Defenders

Who is affected. The people most directly affected are the individuals whose SSNs, birth dates and addresses were in the exposed files, and the vendors whose proposals and pricing were visible across the agency. GSA's breach-notification process is supposed to reach them. If you are a GSA vendor or an individual who has given GSA personal data and you are contacted, follow the notice's instructions. The usual steps after an SSN exposure, such as watching credit reports and considering a credit freeze, are a reasonable precaution even though no outside exposure has been reported.

Why contractors should read this report. Any contractor that handles CUI faces the same need-to-know question the OIG applied to GSA, and many run on Google Workspace or Microsoft 365 too (an inference, not something the report says). The GSA findings work as a ready-made self-audit list:

Check organization-wide sharing. Find files and folders shared with "everyone in the organization" or with link-based access, and review them for CUI first. Agency-wide sharing is the specific failure here.
Review your DLP rules on a schedule and keep records. The auditors found missing records of search-term reviews, not just missing reviews. If you cannot show a review happened, you cannot demonstrate it to an auditor.
Know your tool's limits. Find out whether your DLP scans images and scanned PDFs (OCR) and what its maximum file size is. Scanned forms and image-based documents fall into the OCR blind spot, and very large files can fall into the size one.
Detect your own markings. If your documents carry CUI or legacy "FOUO" banners, make sure your detection rules look for those exact markings. A third of GSA's files were marked and still missed.
Put approval in front of broad sharing. A required approval step before anything is shared domain-wide, together with a naming convention that flags sensitive files, covers the two process gaps the OIG identified.
Don't treat "no external exposure" as a clean result. Contractors, temporary staff and employees outside a project are all outside the need-to-know boundary. CUI rules apply inside your perimeter as well as at its edge.

The broader lesson from the report is that buying the control was the easy part. GSA paid for a DLP platform. What it lacked was the routine upkeep: reviewing rules, confirming what the tool actually covers, and controlling who can share with whom. That upkeep is what auditors check, and the OIG's findings show recurring CUI exposure at GSA, first reported in 2014 and again in this year's report.