# GSA Tightens Google Drive CUI Controls

A GSA Office of Inspector General audit found that 116 Google Drive files containing controlled unclassified information (CUI)—including personal data, vendor proposals and pricing, proprietary research, and building-security details—were accessible to GSA employees and contractors without a legitimate need to know. GSA agreed with the audit’s seven recommendations and reports corrective actions underway, including tighter access restrictions and adoption of optical character recognition. The information was not exposed externally, and the audit announced no solicitation or new contract. The extracted entities report **$7.8 million spent as of September** on a third-party data-loss-prevention tool, but do not identify a related contract award or contractor.

- Contractors handling GSA information should expect heightened scrutiny of CUI access, sharing practices, and document-governance controls.
- The audit points to potential demand for CUI discovery, data-loss-prevention improvements, access-control remediation, and related training, but does not establish a funded procurement opportunity.
- Companies providing cloud security or information-governance capabilities can use the findings to assess how their offerings address CUI discovery and need-to-know access controls.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Cloud Services, Regulatory Compliance
**Published:** October 29, 2026

### Government Entities
- General Services Administration (GSA)
- General Services Administration Office of Inspector General (GSA OIG)

### Vendors
- Google (Google Drive and Google Workspace platform provider)

### Sources
- [GSA exposed sensitive information to all agency users on Google Drive, OIG finds | FedScoop](https://fedscoop.com/gsa-exposed-sensitive-information-on-google-drive-watchdog) - FedScoop
- [GSA left sensitive information in its Google Drive exposed, watchdog finds - Nextgov/FCW](https://www.nextgov.com/cybersecurity/2026/10/dhs-leak-exposes-contact-information-intelligence-personnel/416916) - Nextgov/FCW
- [GSA left sensitive information in its Google Drive exposed, watchdog finds - Nextgov/FCW](https://www.nextgov.com/cybersecurity/2026/10/gsa-left-sensitive-information-its-google-drive-exposed-watchdog-finds/416886) - Nextgov/FCW