Summary

  • Executive Order 14158 called for full and prompt USDS access to unclassified agency systems; a later GAO audit could not reconstruct the permissions behind access reported by four agencies.
  • The four reporting agencies collectively named more than 23 systems and left requests to inspect account roles, privileges and user logs unanswered; SBA and VA supplied no system list.
  • CFPB said there had been no related cyber or privacy incidents and described its safeguards. GAO recorded that account and log records were not made available for observation.
  • Auditability starts with a dated chain from each user to an approved role, an action record and a recorded access shutoff.

GAO-26-108192 leaves a clear split: four agencies reported systems; two named none. The first four said their teams had access to more than 23 systems together. Their records still left GAO unable to establish access levels or inspect account roles and activity logs.

The missing link has a precise technical address: the connection between a person, an account, a system, a permission and a recorded action. Executive Order 14158 made access broad; agency records left its path through accounts and actions unresolved.

The order opened access. The records stopped short

The January 20, 2025 order told agency heads to ensure that the U.S. DOGE Service had “full and prompt access” to unclassified agency records, software and IT systems, to the maximum extent consistent with law. DOGE’s purpose was government technology modernization and efficiency. The audit examined six hosts: CFPB, Department of Education, NOAA, SEC, SBA and VA.

CFPB, Education, NOAA and SEC said their teams collectively had access to more than 23 systems used for contracts, grants, human resources and finance; some held personally identifiable information. Those agencies supplied the combined figure. GAO says their records did not establish the extent or level of access. SBA and VA did not identify the systems their teams could reach.

The temporary USDS organization ended on July 4, 2026. GAO noted that the order did not end the broader USDS entity, so USDS and agency DOGE personnel could continue. That distinction makes account closure and assignment dates practical questions, not footnotes. The audit was published in September, after the temporary organization’s end date, and still could not show the full access map.

Permission describes capacity; logs show action

The gap matters because a system name says little about what its users could do. A person may have read-only access to one record set, edit rights in another, or an administrative role that changes other people’s access. To answer that question, GAO asked the four agencies that had supplied system information to show the role assigned to each account, the privileges attached to each role and the logs recording each account’s actions. By September 2026, the agencies had not responded to those observation requests.

CFPB’s account makes the distinction concrete. The bureau told GAO that two team members had privileges sufficient to grant access to themselves or others, and its chief information officer affirmed the bureau’s statement that they did not do so. CFPB reported no cybersecurity or privacy incidents involving its DOGE team. GAO recorded those statements, but inspectors could not see the systems or logs that would show how access was granted and monitored.

The supporting controls were uneven too. Across the six, CFPB, Education and SEC supplied limited control records; NOAA, SBA and VA did not respond to those control requests. CFPB documented a privacy briefing for six team members and security training for four, but did not supply the requested evidence for everyone. Education produced system rules signed by five of six members and did not provide the remaining document after repeated requests. SEC showed one background check underway and an older investigation from 2017, without confirming that the older check had been favorably adjudicated.

The chain ends where the audit should begin

GAO selected 15 controls from NIST SP 800-53 covering system access, integrity, confidentiality and monitoring. The account-management record is concrete: identify each account holder, record permissions, verify required training and signed agreements, preserve activity logs, and revoke access when a person leaves. The audit sought evidence at each connection.

The six agencies gave different reasons for the missing records. CFPB cited redundancy, operational disruption and the burden of further requests. Education cited pending litigation and confidentiality concerns. SEC disputed GAO’s authority for this review; NOAA also said it lacked authority. VA said it would not respond and supplied no reason; SBA had not explained its nonresponse by September. GAO answered that 31 U.S.C. §§ 716 and 717 authorize the Comptroller General to obtain records and conduct evaluations, and that the objections did not diminish its access rights.

Agencies can protect personal details while letting an auditor inspect roles, privileges, approval dates and activity logs. GAO says it routinely protects sensitive material and has arranged controlled inspections with agencies. Those procedures let oversight test access decisions while system configurations remain protected.

The audit documents a broken evidence chain. Four agencies identified more than 23 systems but did not provide GAO an inspectable path from account roles to logged actions; two named no systems. The public record cannot show, account by account, which systems were reachable, what actions each role allowed or what the logs recorded.

A broad mandate is easy to publish. Accountability begins when the host agency can produce the permission map and the log that goes with it.

Sources