OIG Finds GSA's $14.6B Landlord Agency Mislabels Sensitive Contract Data

By Daniel Okafor

The General Services Administration's Public Buildings Service failed to properly mark sensitive contract documents across a portfolio of nearly 9,000 contracts worth more than $14.6 billion, according to an Office of Inspector General report released Friday. The watchdog's verdict is blunt: PBS does not "provide adequate oversight of its electronic contract files." What that means in practice is missing documentation, inconsistent classification markings, and sensitive acquisition data sitting at risk of exposure.

The scale matters. PBS is the federal government's landlord, and $14.6 billion in contract value is roughly what a mid-sized Fortune 500 company spends annually on facilities and services combined. The failures are not hypothetical. They were found in a sample.

What did the OIG actually find?

Auditors reviewed 11 closed contracts between February 2025 and March 2026 — a small sample, and the report does not say whether the problems extend across the full 9,000-contract portfolio. Within that sample:

• Documents were incorrectly or inconsistently marked as controlled unclassified information, or lacked CUI markings entirely.
• Acquisition plans, contractor personnel security information, and independent government estimates were never designated as CUI at all.
• Required documentation was not consistently maintained in the official system, the Electronic Acquisition System integration, known as EASi.
• Contracting personnel did not consistently use the service's mandatory file checklist and contract review practices.

"Overall, these deficiencies occurred because PBS contracting personnel lack a clear understanding of CUI requirements," the report said. That is a training failure before it is a technology failure — though the technology record is poor too.

The consequences the OIG spells out are not cosmetic. "Maintaining complete and accurate contract files is important, because it reduces the risk of missing documentation, unauthorized disclosures, improper payments, procurement disputes, and noncompliance with federal regulations," the report said. Improper payments and procurement disputes translate directly into money.

Why did the files fall apart?

Staffing is the central explanation, and it is stark. PBS lost 49% of its acquisition personnel in the 2025 staffing reductions — nearly one in two procurement staff, gone within a single year. Many "of these acquisition personnel left incomplete contract files, forcing PBS officials to search extensively for required documents in response to our audit queries," the OIG said. Half a workforce departing mid-contract leaves a records gap no checklist can close retroactively.

Oversight also collapsed structurally. PBS previously relied on GSA's Office of Government-wide Policy Procurement Management Review Division to review contract files. After the 2025 reorganization, that division stopped doing contract file reviews entirely. PBS now has no centralized review process of its own — a gap the agency had apparently not replaced before the reorganization took effect.

Google Drive or the system of record?

The most telling detail concerns where documents actually live. "PBS contracting officers also stated that they did not consistently upload documents into EASi because they found network drives or GSA's Google Drive easier to use for contract file storage," the report said. Staff bypassed the designated system of record because consumer-grade storage felt simpler. That admission carries weight given recent history.

Just last month, the same OIG found GSA was "not effectively" protecting CUI in its Google Drive, exposing sensitive information to all GSA users and contractors agency-wide. Two consecutive reports, two related failures: sensitive data in a shared drive, and contract files that never made it to the official repository. The pattern suggests a systemic data-governance problem, not isolated sloppiness.

"PBS did not ensure that contract documents containing CUI were properly designated and marked, increasing the risk of unauthorized disclosure and mishandling of sensitive acquisition information," the report said.

What happens next?

Acting PBS Commissioner Michael Gelber concurred with the OIG's findings. He is "working on a plan" to address four recommendations: strengthen contract file management, evaluate EASi for improvement, strengthen oversight, and provide CUI training.

A concurrence is not a fix. The word "plan" appears in the response without a deadline, budget figure, or named owner for any of the four recommendations. Skeptics will note that the agency concurred while conceding it has no centralized review process and no completed training program — after a Google Drive exposure report already put CUI handling on the agenda a month earlier.

The unanswered question is the sample size. Eleven contracts reviewed out of nearly 9,000 is a fraction of one percent. If the error rates in the sample hold portfolio-wide, the number of unmarked or misplaced CUI documents would run into the thousands. The OIG did not extrapolate, and PBS did not volunteer its own count.