Summary

  • In a non-generalizable GAO sample of eight cloud systems at four federal agencies, three fully implemented continuous monitoring and three fully implemented documented incident response and recovery; five were partial on each practice.
  • The missing handoffs were concrete: the Department of State did not show review of monitoring deliverables for its selected PaaS system, the Department of Veterans Affairs (VA) did not provide evidence it collected and reviewed provider audit logs for either selected system, and some service-level agreements lacked measurable, enforceable security terms.

The security binder is not the security shift

The GAO's June 2026 investigation looked at two systems each at the U.S. Department of State, Department of Transportation, Department of Veterans Affairs (VA) and Small Business Administration (SBA). It chose four agencies by their number of cloud authorizations, then reviewed a range of platform and software services. GAO withheld the systems' names because of sensitivity. This was a non-generalizable sample of eight systems, not a score for every federal cloud installation.

The audit tested three duties that sit exactly at the agency-provider boundary. Continuous monitoring requires the agency to keep sight of its controls and the provider's output. Incident response requires a documented way to identify, contain, report and recover with the provider. The service-level agreement must say what the provider must deliver, how performance will be measured and what happens when it falls short. A security authorization can establish a basis for using a service; these duties determine whether someone is still watching it after the purchase.

Only three of eight selected systems fully met GAO's continuous-monitoring criteria. The other five partially met them. Some agencies had a monitoring plan without proof that every part was being performed. State showed it had reviewed deliverables from its selected SaaS provider, but not those from its selected PaaS provider. VA had plans and audit-log policies for both systems, yet did not give GAO evidence that it collected and reviewed the provider logs. SBA reviewed deliverables and logs for its selected SaaS system, but did not show the same for its PaaS system.

These are documented evidence gaps in specified systems, not a finding that a breach occurred.

A provider can test an alarm the agency has never heard

Three of the eight systems fully met the incident response and recovery practice; five partially met it. Transportation's two systems were fully covered on this measure. State's selected PaaS system lacked documented procedures for coordinating with the provider, despite procedures covering other parts of response. VA lacked a way to measure and track response time for its PaaS system and a documented test procedure for its SaaS system. VA officials said a vendor had tested in October 2025, but evidence of the test or its procedure was not provided to GAO.

Provider ownership of a system does not supply the agency with an incident timeline on demand.

SBA had an unsigned incident response plan and gaps in prompt provider notification and coordination. The practical issue is a handoff under pressure. When a provider sees suspicious activity, who must tell the agency, by what channel, within what time, and who checks that the agency received and acted on the warning? A document naming the parties without testing their sequence is a weak instrument for an actual incident. The report identified missing procedures and evidence; it did not identify an actual failed response to a named attack.

The contract layer was mixed as well. Five of eight selected systems had service-level agreements that fully defined the required performance terms. One was partial; two lacked security metrics. VA's SaaS agreement named metrics but not how they would be measured or enforced. For its PaaS system, VA pointed to general website language rather than an agency-provider agreement with metrics, measurements and enforcement. SBA had a complete agreement for its selected PaaS system but no such agreement for its SaaS system.

A metric without a measurement method is decoration; an obligation without an enforcement path is hope dressed as procurement.

The agency still owns the question

The full official report found that one of the four agencies fully implemented all three practices for both selected systems and another did so for one; the remaining five systems were partial overall. GAO made 12 recommendations: two to State, five to VA and five to SBA. Transportation received none in the final report after supplying documentation that resolved a proposed finding. This matters because the audit evaluated records provided, not a vague impression of agency competence. Better records changed a finding where they existed.

FedRAMP and cloud authorization reduce duplication in vetting service offerings. They do not collect a VA audit log, review a State provider's monitoring packet or write SBA's incident call tree. Each agency must put an owner and a date on those actions. Later evidence that the provider reports were read, logs were reviewed, incident exercises were run and SLA terms became measurable would change this assessment. The report makes no claim that one of the eight systems suffered a breach.

Heng Lu's argument for judging institutional claims by running practice is an analytical lens, not a source of federal cloud facts. Here the running practice is less glamorous than an encryption diagram: a real analyst opens the deliverable, reads the log, checks the alarm route and tests the recovery clock. The server may belong to a provider. The question of whether the agency saw what happened on it still belongs to the agency.

Sources