A keyword list is not a classification system. On October 27th 2026, the General Services Administration's Office of Inspector General released an audit showing what happens when it is treated like one. In a limited search of GSA's Google Drive, auditors found 116 files containing controlled unclassified information (CUI) that had been shared with employees and contractors who had no business reason to see them, as reported by Nextgov/FCW. The files included Social Security numbers, proprietary research, vendor proposals, and site plans for a Washington, D.C. building.
GSA IT's review found the documents were not exposed externally and showed no indication of malicious intent. It agreed with all seven recommendations and took corrective action while the audit was underway. The audit still matters to every organization that keeps CUI in Google Drive or SharePoint, including the defense contractors who protect it under NIST SP 800-171 and CMMC. The detection model it describes is the one most of them run.
This analysis covers what auditors found, why keyword-based detection missed the files, how a workspace-wide share expands your blast radius, and what to check in your environment this week.
Key Findings from the GSA Google Drive CUI Audit
The audit found two problems: sensitive files were visible to the wrong people, and a detection tool didn't catch them.
| Audit Category | Detailed Findings |
|---|---|
| Exposure | 116 CUI files shared with employees and contractors who lacked a operational need-to-know |
| Data Types | Social Security numbers, phone numbers, proprietary research, vendor proposals, and Washington, D.C. facility site plans |
| Detection Tool | Third-party DLP tool scanning shared files for CUI keywords to restrict access, flag, or alert owners |
| Tool Gaps | Incomplete annual search-term reviews; missing agency guidance terms; OCR disabled; unmonitored 15 MB file size limit |
| Process Gaps | Absence of formal sharing approval workflows, lack of standard CUI naming conventions, and undocumented operational rules |
| Recommendations | Seven formal recommendations ranging from immediate access restriction to broad CUI remediation and DLP rule overhauls |
This is not a first. The same inspector general reported in 2014 that GSA had not protected information in its Google Cloud environment, issued further reports between 2015 and 2017, and found in April 2025 that Google Drive held documents with sensitive information that users did not need to see.
Audit Your Cloud Data Exposure Before Auditors Do
Connect Theodosian to your Google Drive and SharePoint in minutes with zero data migration. Continuously discover CUI and sensitive assets, surface over-broad workspace permissions, and evaluate real risk across your storage.
5 Technical Failure Points of Keyword-Based DLP
Keyword detection finds what its list describes. It cannot find what the list leaves out. Each gap in the audit follows from that design.
| Gap Identified in Audit | Structural Limit of Keyword Detection | Question to Ask Any DLP Vendor |
|---|---|---|
| Search terms not fully reviewed annually | Rules drift and lose accuracy as agency guidance and projects evolve | Who maintains detection rules, and what happens when updates lag? |
| Key guidance terms missing | Detection coverage is limited strictly to explicit term lists | Does the tool classify by content context or static term lists? |
| OCR disabled | Scanned documents, PDFs, and embedded image files render as unreadable text | How does the solution handle scanned pages and image payloads? |
| Unmonitored 15 MB file size limit | Large architectural plans, databases, and decks bypass scanning without alert | What is the hard file size scanning limit, and how are oversized files handled? |
| Response limited to flags and emails | Enforcement relies on manual human action after exposure occurs | What access control decision is made at the precise moment a file is opened? |
The audit describes management gaps. It also describes a model that depends on people maintaining a list every year, and a tool that tells a person after the fact. A report about your exposure is not a reduction of your exposure.
Theodosian's discovery works differently. It scans every file in your cloud data stores, including SharePoint, Google Drive, and Box, one at a time in isolated sandboxes, in memory only. An agentic classification engine labels each file by what it contains, such as PII, ITAR, or trade secrets, with no manual data-mapping project. You see where your sensitive data lives and which people and AI agents can reach it, and the inventory stays current as your files change.
How Workspace-Wide Sharing Expands Third-Party Data Exposure
A file visible to everyone in a workspace is a file exposed to every account in it. GSA's own response says it restricted documents shared domain-wide. In a Drive with thousands of users, one sharing setting is the difference between 116 files reaching a handful of people and reaching all of them.
The pool is wider than staff. The audit found contractors with access, and Verizon's 2026 Data Breach Investigations Report found that third parties were involved in 48% of breaches, up from 30% a year earlier. The same report found that 45% of employees are now regular AI users on corporate systems, and an AI assistant connected by any one account reaches whatever that account can reach.
Unrestricted workspace permissions create severe security exposure. To prevent over-broad access, security controls must apply directly to the file layer rather than relying on perimeter container rules.
File-Layer Security: Addressing Audit-Identified DLP Gaps
File-level controls move the decision from the folder to the file. Each of the three jobs maps to a failure in the audit.
Discover and classify: Continuous discovery replaces the keyword list. Every file is inventoried and labeled, and you see which people and which AI agents can reach it. Files that are shared too broadly show up as findings you can sort, not as a surprise in an audit.
Protect and control: Labels drive policy. For restricted CUI or high-risk files, per-file FIPS 140-3 validated encryption governed by more than twenty contextual controls, including cleared groups, MFA at open, device, location, and network checks, enforces need-to-know at the file itself. A workspace-wide share does not open a protected file to anyone outside the group you named. Access can be narrowed to one person or to no one, and not even Theodosian can read those files. AI egress rules decide which users can send which classes of data to which AI tools: block, limit to approved tools and groups, or allow with sensitive fields redacted. Theodosian Guardian watches for anomalous behavior such as mass downloads and unfamiliar devices, and Drop the Gate freezes access on encrypted files automatically.
Govern and audit: Every file action is recorded: who or what opened it, when, from where, and on what device. When your compliance team exports the log, an assessor can verify cryptographically that it has not been altered. Theodosian implements many of the controls that compliance frameworks require, including NIST 800-171, CMMC, and HIPAA's encryption requirements for PHI.
File-level controls do not write a sharing approval process, set a naming convention, or train staff. Those were among the audit's recommendations, and they remain policy work. What changes is what the file does when policy is not followed.
5-Step Audit Checklist for CUI File Security
Five checks take a day and tell you whether you are running the same model.
1. Count the CUI files shared more broadly than need-to-know: Include workspace-wide shares, anyone-with-the-link shares, and groups that outlived their projects.
2. Find out when your detection rules were last reviewed: If the answer is "I'm not sure," that is the finding.
3. Test scanned files and large files: Drop a scanned CUI page and a file above 15 MB into a test folder and see whether the tool flags either.
4. Check what contractors and guests can reach: Third parties are where the sharing pool is widest.
5. Ask what happens at the moment of access: If detection ends in an email to the file owner, the file is exposed until someone acts.
Auditing Your CUI Exposure in a 14-Day Pilot
Start with a guided walkthrough. If it holds up, Theodosian connects read-only and shows you your exposure within days: where your CUI lives and who and what can reach it. Test any rule in simulation before it blocks anything, so it never interrupts normal workflow. By day fourteen, enforcement is live on your own files, with an audit trail you can put in front of your board.
Deployment requires zero structural migration or lengthy implementation projects. Existing DLP tools remain operational while side-by-side performance is evaluated.
The platform is single-tenant, supports in-region scanning and data residency, and offers self-hosted and FedRAMP High deployment options. It is independently verified through FIPS 140-3-validated encryption, SOC 2 Type 2, and penetration testing by CREST-accredited auditors.
Enforce File-Layer Control Over CUI Data
Move beyond fragile keyword lists and perimeter alerts. Automatically discover sensitive unstructured assets, enforce per-file FIPS 140-3 encryption, and protect CUI wherever it travels.
FAQs: CUI Exposure in Google Drive and SharePoint
How do I find CUI files that are shared too broadly in Google Drive or SharePoint?
Continuous discovery inventories every file, labels it by what it contains, and shows which people and AI agents can reach it. Theodosian connects read-only to Google Drive, SharePoint, and Box, so you see your own exposure within days and before any policy is set.
Does Theodosian replace our DLP tool?
No. Theodosian works alongside existing tooling. DLP tells you a transfer or exposure happened. Theodosian classifies the file, decides at the moment of access what a person or an AI can do with it, and records every action. Run both during the proof of concept and compare.
Will protecting CUI change how my team works in Google Drive?
Everyday files stay searchable, shareable, and collaborative. Protection is proportional to sensitivity, so only the files that must never leak carry per-file encryption and contextual access controls.
What does an auditor see when someone without a need to know tries to open a CUI file?
For a protected file, the request is denied and logged with the identity, device, location, and time. The exported log is cryptographically verifiable, so an assessor can confirm it has not been altered.
How long does it take to see what is exposed?
Discovery begins within minutes of connecting read-only. Within days, you have a full map of where your sensitive data lives and who and what can reach it.