Controlled Unclassified Information in GSA’s Google Drive Was Improperly Exposed

Why We Performed This Audit

GSA uses Google Workspace to collaborate across the Agency. GSA’s implementation of Google Workspace includes Google Drive, which is a tool that allows all GSA users to store, share, collaborate, and access files from a mobile device, tablet, or computer.

According to GSA management, GSA users and contractors currently have 2.5 million documents stored in GSA’s Google Drive. Some of these documents contain information that, while not classified, still requires some level of protection from unauthorized access by individuals who do not have a legitimate business need to know. This information is referred to as controlled unclassified information (CUI). Examples of CUI used by GSA include:

• Physical Security Information – Information related to the security of federal buildings, grounds, and property. This information includes floor plans and blueprints, as well as information on building security assessments, counterterrorism methods, and building automation systems.
• Personally Identifiable Information – Information that can be used to distinguish or trace an individual’s identity. This information includes social security numbers, dates of birth, and home addresses. 
• General Proprietary Business Information – Information related to a company’s products, business operations, or activities. This includes information on a company’s trade secrets, product research and development, existing and future product designs, and performance details.

In August 2014, we first reported that GSA did not protect sensitive information on child care centers, courthouses, water sources, building automation systems, and security and fire alarm systems in its Google cloud computing environment. We issued additional reports citing concerns regarding GSA’s ability to protect sensitive information in its Google environment between 2015 and 2017.

In April 2025, we again identified unauthorized exposures of CUI in GSA’s Google Drive. The exposed information included safety surveys showing detailed blueprints. We also found a site development plan in Washington, D.C.; and a vendor’s full bank account number and wire transfer information.

Because of its sensitivity, GSA must ensure that CUI stored in its Google Drive is properly protected against unauthorized exposure. Accordingly, we included this audit on our Fiscal Year 2025 Audit Plan. Our audit objective was to assess the effectiveness of security controls and privacy settings in place to protect the confidentiality, integrity, and availability of information stored within GSA’s Google Drive as required by federal and Agency information technology security policies, procedures, standards, and guidance.
 

What We Found

GSA is not effectively protecting information stored within its Google Drive, resulting in unauthorized exposures of CUI. During a limited search of GSA’s Google Drive, we found 116 files containing CUI that were improperly shared with all GSA users. As a result, the CUI was exposed to GSA employees and contractors who did not have a legitimate business need to know. The improperly exposed CUI included:

• Physical Security Information - Exposures of physical security information can create safety and security risks for building occupants. We found physical security information exposed in GSA’s Google Drive, such as counterterrorism methods, continuity of operations plans, and blueprints showing access points to sensitive areas of federal buildings. Specific examples include:
  • Site plans in Washington, D.C. The plans identify site entrances, badge holder and visitor routes, screening areas, and screening techniques.
  • A progressive collapse analysis that describes the building’s collapse vulnerabilities, defense vulnerabilities, and critical failure locations.
  • A presentation that includes floor plans showing sensitive areas of the building. The sensitive areas shown in the floor plans include gun lockers, judges’ chambers, jury rooms, metal detectors, and x-ray screening areas.
• Personally Identifiable Information – Exposures of personally identifiable information leave affected individuals vulnerable to identity theft, financial loss, embarrassment, and inconvenience. We found personally identifiable information exposed in GSA’s Google Drive, including social security numbers, dates of birth, phone numbers, and addresses.
• General Proprietary Business Information - Exposures of general proprietary business information could reveal a company’s trade secrets or business practices and be exploited by competitors. We found general proprietary business information exposed in GSA’s Google Drive, including proprietary research and vendor proposals with technical and pricing information.

GSA did not detect that the CUI was exposed in its Google Drive because of deficiencies in its oversight. Specifically, GSA does not effectively manage its data loss prevention tool, which is a third-party software application used to prevent and detect CUI exposures. We found the following deficiencies in GSA’s management of this tool:

• GSA has not fully completed annual reviews of the tool’s search terms to ensure effective detection of CUI;
• Searches using the tool did not detect exposed documents that included current search terms;
• GSA did not incorporate many relevant terms from the Agency CUI guidance into the tool’s search terms;
• GSA did not implement the available tool feature—optical character recognition—that could prevent some CUI exposures;
• GSA was unaware of the tool’s file size limitation of 15 megabytes; and
• GSA did not document program decisions affecting CUI protection in Google Drive.

We also found that GSA lacks: (1) an approval process for properly sharing sensitive information and (2) a standard naming convention that could more effectively prevent exposures of CUI in GSA’s Google Drive.

What We Recommend

We recommend that the GSA Chief Information Officer:

1. Restrict access for all 116 CUI documents exposed in GSA’s Google Drive to only GSA users with a lawful government purpose to access that information.
2. Identify other CUI documents exposed to all GSA users not found during this audit and restrict these documents to only GSA users with a lawful government purpose to access that information.
3. Identify and notify the individuals affected by the exposed information in accordance with the GSA Information Breach Notification Policy.
4. Identify and implement additional controls to ensure that Agency employees only share CUI documents in GSA’s Google Drive with users who have a lawful government purpose to access that information. At a minimum:
   1. Implement an approval process for sharing CUI documents in Google Drive with all GSA users.
   2. Develop a standard naming convention for CUI documents to more effectively identify and protect CUI in GSA’s Google Drive.
   3. Update Agency guidance and training materials to further emphasize the importance of CUI, the different categories of CUI, and how to appropriately flag CUI documents in Google Drive.
5. Improve management of the data loss prevention tool to better detect and prevent CUI exposures in GSA’s Google Drive. Specifically, GSA’s Security Operations & Engineering Division should:
   1. Review, update, enforce, and document the process for the annual review of the data loss prevention tool’s search terms.
   2. Incorporate relevant terms from GSA’s CUI guidance into the data loss prevention tool’s search terms.
6. Assess and implement available enhancements to the data loss prevention tool to maximize detection and restriction of CUI exposures in GSA’s Google Drive. The Security Operations & Engineering Division should:
   1. Evaluate the current data loss prevention tool’s optical character recognition feature for implementation.
   2. Develop a process for evaluating new data loss prevention tool features for implementation.
   3. Evaluate methods to identify exposed CUI documents larger than 15 megabytes and safeguard those documents.
7. Develop and implement a process to document and maintain management and operational decisions for the data loss prevention tool.

GSA’s Chief Information Officer agreed with our recommendations. GSA’s comments are included in their entirety in Appendix E.
 

NOTE: Redactions in this report represent sensitive physical security, personally identifiable, and general proprietary business information.