The search found 116 exposed files
The GSA inspector general found 116 files containing controlled unclassified information shared with all GSA users during a limited search. The material included physical-security information, personally identifiable information and proprietary business records.
The exposure was broader than a lawful need to know, according to the audit. The report does not say the files were public on the open internet or prove that an outsider downloaded them.
The detection system missed known risks
Auditors said GSA did not fully maintain search terms for its data-loss-prevention tool, had not enabled an available optical-character-recognition feature and was unaware of a 15-megabyte file-size limitation. The agency also lacked a standard approval process and naming convention for sensitive files.
The limited search means 116 is a confirmed minimum, not necessarily the full universe. One recommendation directs GSA to find other exposed files outside the audit sample.
Seven recommendations remain open
The watchdog recommended restricting the 116 files, searching for more, notifying affected people where required and strengthening controls, training and documentation. Oversight.gov lists all seven recommendations as open.
GSA agreed with the recommendations. Closure should require evidence that access was narrowed and the detection gaps were addressed, not simply that a remediation plan was written.
Sources and further reading
GSA Inspector General: controlled information exposed in Google Drive ↗