What was exposed is not trivial. The improperly shared files included site plans for Washington, DC buildings showing entrances, screening techniques and the location of sensitive areas such as gun lockers, plus a progressive collapse analysis describing the building's collapse and defense vulnerabilities and critical failure locations. Employee personally identifiable information was also open, including social security numbers, addresses, dates of birth and contact details, alongside proprietary business information such as vendor proposals with technical and pricing information.

The exposure was not public, but contractors with access to the Drive could potentially view proprietary material belonging to competing vendors, which, per the audit coverage, could give them an unfair advantage if they used it. The OIG also found GSA is failing to manage its data loss prevention tool: annual reviews of search terms were incomplete or undocumented, many relevant terms were never implemented, and an available optical character recognition feature that could spot CUI in scanned documents was not enabled. GSA was apparently unaware of the tool's 15 megabyte file size limit, meaning some large files would be skipped even with proper use.

This is a familiar refrain. The OIG first reported in August 2014 that GSA failed to protect sensitive information on child care centres, courthouses, water sources, building automation systems, and security and fire alarm systems in its Google environment, issued further critical reports between 2015 and 2017, and flagged another set of improperly shared Drive files in April 2025. GSA's chief information officer agreed with the auditors' seven recommendations, but the report does not establish whether the corrective work has been completed.