The General Services Administration’s (GSA) Inspector General found that 116 files containing controlled unclassified information (CUI) were improperly shared with all GSA users, exposing them to employees and contractors without a legitimate business need to access them, according to an October 27 audit report.

The audit examined GSA’s Google Drive, which contains about 2.5 million documents belonging to GSA employees and contractors. 

The exposed information included Social Security numbers, dates of birth, phone numbers and addresses, as well as proprietary research, vendor proposals and physical-security information about federal buildings.

The audit found that GSA’s data loss prevention (DLP) controls did not effectively detect the exposed files. The agency had not fully completed annual reviews of the tool’s search terms, had not incorporated many relevant terms from its CUI guidance and had not enabled optical character recognition, which could detect sensitive information in some documents.

GSA also lacked an approval process for sharing sensitive information and a standard naming convention that could help identify CUI documents. The DLP tool’s 15-megabyte file-size limit, which GSA did not know about, created another potential detection gap.

External Exposure and Response

GSA’s IT review determined that the identified documents were not exposed externally and found no indication of malicious intent, according to the agency’s response to the audit.

The Inspector General issued seven recommendations, including restricting access to the 116 files, identifying other potentially exposed CUI documents and notifying affected individuals under GSA’s breach-notification policy.

Data Classification and DLP Gaps Put CDOs in Focus

For chief data officers (CDOs), the audit illustrates how data governance can fail even when information remains inside an organization’s own environment. The problem was not an external breach of GSA’s Google Drive; it was that sensitive files were available to people internally who had no legitimate need to access them.

The findings also highlight the importance of keeping data governance controls aligned with how information is actually stored, classified and shared. CDOs responsible for sensitive data need visibility into access permissions, classification practices and the tools used to detect inappropriate sharing.