A lot of computer security at a big organization is paperwork, and that isn’t a criticism. Imagine you get hired at a bank and need into the system that holds customer accounts. You sign a document promising to behave. You sit through a training. Someone runs a background check. Someone decides exactly what you’re allowed to do in there: read, edit, delete. The system keeps a log. Later an auditor turns up and asks for the paperwork, and if it exists, everyone relaxes. The paperwork is the control. If you can’t produce it, the auditor has no way of telling whether you had controls at all, and from the outside that looks just like not having them.
So. On Sept. 29 the Government Accountability Office published a report called “DOGE: Congress and the Public Lack Assurance That Systems and Data Were Protected at Multiple Agencies,” and the title is pretty much the finding. GAO, which audits on behalf of Congress, looked at Department of Government Efficiency teams at six places: the Departments of Education and Veterans Affairs, the Consumer Financial Protection Bureau, the National Oceanic and Atmospheric Administration, the Securities and Exchange Commission and the Small Business Administration. It wanted to know two things. Which systems did the DOGE teams get into, and did the agencies have controls to make sure those teams followed IT security rules? As Laine Bergeson reports for CIDRAP, the agencies sent back incomplete documentation or nothing.
The teams exist because of an executive order President Donald Trump signed on Jan. 20, 2025, with the stated goal of modernizing federal technology and making government more efficient. It told agency heads to set up DOGE teams to work with the U.S. DOGE Service. GAO’s audit ran from March 2025 through September 2026. The report explains why anyone was worried: “The breadth of this access has led to concerns by members of Congress and others that agency systems and their sensitive information and data may have been vulnerable to unauthorized disclosure or modification.”
The access
Four of the agencies (CFPB, Education, NOAA and SEC) said their DOGE teams had access to “more than 23 systems” covering human resources, finances, grants and contract management, some of them holding personally identifiable information. “More than 23” is a funny number. You end up with it when you add up what people told you and you know they didn’t tell you everything. GAO also couldn’t work out from what it was given whether individual team members had specific permissions, such as viewing personal data or changing records.
Some details did come through. At CFPB, one DOGE team member got access to eight internal systems and could view, modify and delete data in the bureau’s main human resources system. Those are the three verbs that matter, and the third is the one auditors lose sleep over. At Education, two of the six DOGE members had access to the department’s IT systems and network, but GAO couldn’t confirm how far that access went. At SBA and VA, GAO couldn’t even identify which systems the teams could reach.
That’s the access side.
The controls
On whether anyone followed the rules, three agencies (CFPB, Education and SEC) sent limited documentation. The GAO summary shows what limited means. CFPB showed that six DOGE team members got a privacy briefing and four finished security training, with no proof of training for the rest. Education sent rules-of-behavior documents signed by five of its six DOGE team members and didn’t answer repeated requests for the sixth. A rules-of-behavior document is basically a signature, so five out of six is 83 percent on the easiest item in the whole exercise. The SEC showed a background check underway for one team member and another done in 2017 for a second, and didn’t confirm whether the 2017 check was favorably adjudicated. NOAA didn’t answer GAO’s questions about controls. SBA and VA provided nothing on access or on controls.
CFPB and SEC both told GAO there had been no privacy incidents involving DOGE access. Neither said how it determined that. This matters more than it seems. “No incidents” really means “no incidents we detected,” and how much that’s worth depends on how hard you looked. Nobody showed GAO how hard anyone looked. The report concludes:
Consequently, Congress and the public lack information needed to confirm if DOGE team members followed the IT rules of behavior they agreed to at these agencies.
The excuses, ranked
The agencies gave different reasons for holding back. CFPB said the information requested was redundant and unnecessary, and that providing it would unnecessarily disrupt bureau operations. Education pointed to ongoing litigation and to concerns about the confidentiality of DOGE personnel. NOAA and the SEC challenged GAO’s authority to do the review at all. The VA said it would not address the requests and would not give a reason for not addressing them.
I have some admiration for the VA’s version. The other three at least make an argument, about burden or about lawsuits and privacy or about jurisdiction. The VA just said no and didn’t explain. GAO’s reply to all of them is that it “has ample statutory authority to both conduct this work and obtain the information in support of Congress.” CFPB also disputed the accuracy of the draft, and GAO says it “stands by the accuracy of the facts presented in the report.” Education, NOAA, SBA, the SEC and the VA said they had no comments on the draft.
There’s some irony here. DOGE’s whole pitch was that agencies should be able to account for what they do with their systems and their money. Asked to account for what DOGE did with their systems, the agencies mostly declined. It also isn’t GAO’s first report like this. In April it found that Treasury missed security controls when it gave DOGE access to its payment systems. In that case, at least, there was enough paperwork to say what had gone wrong.
Normally, in an audit, missing paperwork is one of the findings. Here the missing paperwork is the entire report.