DOGE: Congress and the Public Lack Assurance That Systems and Data Were Protected at Multiple Agencies

Executive Summary

GAO’s review found that DOGE teams at six agencies (CFPB, Education, NOAA, SEC, SBA, and VA) had access to more than 23 agency systems that contained sensitive information, including PII, but agencies could not or did not provide sufficient documentation to show who had what permissions, whether required training or background investigations were completed, or whether controls were enforced. Several agencies either provided limited documentation or did not respond to GAO requests, leaving Congress and the public without assurance that appropriate protections and accountability were in place. The report frames this as a high-severity oversight gap tied to access, accountability, and compliance with baseline IT and privacy controls.

For contractors, this creates immediate demand signals across multiple market segments named in the Tags (Cybersecurity; IT Services; Information Security; Privacy and Data Protection; IT Security Training; Background Investigation Services; Identity and Access Management; IT Compliance and Audit; System Security; Personnel Security). Contractors should pay attention now because agencies are likely to prioritize (1) demonstrating documented controls and evidence of compliance, and (2) rapidly filling capability gaps for training, investigations, access reviews, and audit/evidence collection — all areas reflected in the GAO findings and the compliance surfaces listed in the Tags.

Impact Matrix

Cybersecurity

• Risk Level: Critical
• Opportunity: High demand for services that can perform access reviews, system permission audits, risk assessments, and remediation planning. Specific NAICS codes and contract vehicles appearing in the Tags include NAICS: 541512, 541519, 541511, 541513 and vehicles: OASIS+, Alliant 2, 8(a) STARS III, VETS 2, GSA (General Services Administration) Schedule 70. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Prepare capabilities for rapid access and permissions assessments, vulnerability and configuration reviews aligned to listed compliance surfaces (e.g., NIST 800-53, NIST Cybersecurity Framework, FISMA). Develop evidence packages showing remediation steps and control implementation.
• Competitive Edge: Offer modular, rapid-assessment packs that produce agency-ready evidence (audit trails, permission matrices) tied to NIST 800-53 and FISMA mappings.

IT Services

• Risk Level: High
• Opportunity: Agencies will need integration support for system access controls, logging, and secure configuration. Relevant NAICS and vehicles are listed in Tags (see above). Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Prepare staff and proposals emphasizing secure system administration, documentation of system access workflows, and integration with IAM and logging systems. Build templates to document system-level controls for GAO-style reviews.
• Competitive Edge: Combine IT ops expertise with pre-built compliance documentation bundles to reduce agency documentation gaps during oversight.

Information Security

• Risk Level: Critical
• Opportunity: Work involving control implementation, continuous monitoring, and producing artifacts that demonstrate adherence to security rules (evidence collection, security plans). NAICS/vehicles from Tags apply. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Offer services to create and maintain security documentation, perform evidence collection, and implement monitoring to demonstrate rule adherence. Align deliverables to compliance surfaces in Tags.
• Competitive Edge: Provide living documentation platforms that automatically collect and present evidence tied to control objectives (e.g., NIST mappings).

Privacy and Data Protection

• Risk Level: High
• Opportunity: Demand for privacy impact assessments, PII inventories, controls to limit access to PII, and proof of privacy training. NAICS and vehicles listed in Tags are relevant. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Prepare privacy assessment templates, PII access questionnaires, and training verification processes to help agencies demonstrate compliance with the Privacy Act and related guidance.
• Competitive Edge: Offer combined privacy-security assessments that link technical access controls to documented privacy responsibilities and training records.

IT Security Training

• Risk Level: High
• Opportunity: Short-term and recurring training contracts to ensure DOGE team members complete required security and privacy training, and to provide evidence of completion. Relevant NAICS and vehicles are listed in Tags. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Prepare role-based training packages, completion tracking and attestation mechanisms, and templates agencies can use to provide evidence to oversight bodies.
• Competitive Edge: Deliver auditable training platforms with exportable completion evidence tailored to agency oversight requests.

Background Investigation Services

• Risk Level: High
• Opportunity: Agencies need to demonstrate background checks and adjudications for team members with access to sensitive systems; opportunity for vendors that support investigations, adjudication tracking, and proof-of-completion reporting. NAICS/vehicles in Tags apply. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Position services to assist agencies in documenting background investigation status, managing follow-ups, and compiling agency-ready evidence.
• Competitive Edge: Integrate investigation tracking with personnel security dashboards that produce GAO-style evidence packages.

Identity and Access Management

• Risk Level: Critical
• Opportunity: Strong demand for IAM solutions to establish least privilege, permission visibility, and audit trails showing who can view/modify PII and other sensitive data. NAICS and vehicles noted in Tags are applicable. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Offer access governance, entitlement reviews, role-based access controls, and reporting that maps access to documented permissions. Prepare to demonstrate change controls and attestation logs.
• Competitive Edge: Provide automated entitlement discovery and attestation tied to evidence exports for oversight.

IT Compliance and Audit

• Risk Level: High
• Opportunity: Services to perform compliance assessments, produce audit-ready documentation, and support GAO or congressional oversight reviews. Compliance surfaces in Tags (NIST 800-53, FISMA, Privacy Act, NIST 800-171 (NIST Special Publication 800-171), FedRAMP (Federal Risk and Authorization Management Program), OMB Circular A-130, NIST CSF) are directly relevant. NAICS/vehicles noted in Tags apply. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Prepare audit packages aligned to the listed compliance frameworks, create gap analyses, and offer remediation roadmaps with timelines and evidence artifacts.
• Competitive Edge: Bundle compliance assessment with remediation sprints and an evidence-retention service to shorten response times to oversight inquiries.

System Security

• Risk Level: High
• Opportunity: System hardening, logging/forensics, and configuration management services to ensure systems accessed by DOGE teams are protected and auditable. NAICS/vehicles from Tags apply. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Offer baseline hardening plans, enhanced logging to capture actions by DOGE users, and playbooks to produce evidence for oversight.
• Competitive Edge: Deliver turnkey logging + analytics solutions that can rapidly produce user-action trails mapped to system accounts.

Personnel Security

• Risk Level: High
• Opportunity: Services that support personnel vetting, security briefings, attestations, and documentation proving completion of security responsibilities. NAICS and vehicles in Tags relevant. Specific opportunities TBD pending solicitation language.
• Timeline: Timeline TBD pending source review.
• Action Required: Provide solutions for tracking briefings, attestations (e.g., rules of behavior), and the status of background investigations; prepare templates for agency use during oversight.
• Competitive Edge: Integrate personnel security tracking with IAM and audit artifacts so agencies can show linkage between personnel status and system permissions.

Cross-Segment Implications

• Gaps in IAM, background investigations, and training create cascading risks: weak personnel security or incomplete background checks increase insider risk, which elevates system security and cybersecurity needs and complicates compliance/audit responses.
• Agencies’ lack of documented evidence ties together demands across IT Services, Compliance & Audit, and Training: contractors that can provide combined technical remediation, documentation/evidence packaging, and verifiable training completions will be in a stronger position.
• Privacy and data protection work (PII inventories, access restrictions) must be coordinated with IAM and system security to ensure that permission changes are enforced technically and recorded for audit purposes.
• Contractors should position cross-functional teams (technical, privacy, personnel security, and audit specialists) to respond to integrated agency requests that are likely to arise from oversight and GAO follow-ups.