Agencies largely stonewall GAO on audit of DOGE’s data practices

An 18-month audit into DOGE’s data security practices yielded few answers for the Government Accountability Office, which released a biting report Tuesday that rebuked several agencies for not providing information or ignoring its requests altogether. 

From March 2025 to September 2026, the GAO reviewed the access that six DOGE teams had to information systems at the agencies in which they were embedded, as well as the controls used to make sure those systems were protected.

The watchdog found that those DOGE teams had access to more than 23 systems across four agencies: the Consumer Financial Protection Bureau, the Department of Education, the Securities and Exchange Commission, and the National Oceanic and Atmospheric Administration.

But the “extent and level of access” that DOGE had to those systems — which were used for human resources, finances, and managing contracts, grants and other functions — “could not be determined based on information the agencies provided,” the GAO said.

“Without the ability to examine the requested information, Congress and the public lack assurance that the six reviewed agencies implemented controls needed to ensure DOGE team members appropriately secured information,” the GAO said.

The Small Business Administration and the Department of Veterans Affairs, meanwhile, did not respond to the GAO’s requests for information on DOGE’s access to agency systems. 

The SBA and VA also did not engage with the watchdog on questions about whether DOGE followed agency controls and IT security rules. Nor did NOAA, whose general counsel told the GAO that it didn’t believe the watchdog had the “necessary statutory authority to conduct an audit at the request of a ranking member of a congressional committee.”

“GAO has ample statutory authority to both conduct this work and obtain the information in support of Congress,” the watchdog wrote. “Despite this clear authority, the agencies did not respond to GAO’s requests for the information needed to fully answer the questions posed by members of Congress. Agencies cited various reasons for not fully responding to GAO’s requests, but their stated reasons do not alter or diminish GAO’s statutory right of access to this information.”

Three of the agencies — the CFPB, SEC and Education — cited pending litigation or “the nature of the information” for not providing the GAO with answers to some of its questions. The watchdog bristled at those justifications as well, writing that those concerns “do not alter or diminish GAO’s statutory right to the requested information.”

“Indeed, GAO has routinely obtained this kind of information from these and other agencies in the past on other cybersecurity audits,” the report stated. “Moreover, GAO has routinely protected this type of information, maintaining the same level of confidentiality as is required of the head of the agency. 

“GAO has a long history of reaching successful accommodations with agencies, including CFPB, Education and SEC, to address concerns about protecting their sensitive information and to obtain the information necessary to complete our audit work,” it added.

The SEC, through a spokesperson, declined to comment on the GAO’s report. The other five agencies did not respond to FedScoop requests for comment by the time of publication.

What the GAO found

The audit, which was requested by ranking members of several Senate and House committees and five other Democratic lawmakers, attempted to piece together the scant information it did receive from the agencies.

For example, two people on the six-person DOGE team at Education had access to its systems and IT network — but the agency didn’t share details about the level of access. The agency also disputed a report about a team member having access to personally identifiable information housed in one system, and didn’t provide clarity on questions of administrative privileges or the ability to delete or alter website content. 

At the SEC, two DOGE representatives went through the agency’s privacy and cybersecurity awareness training. But the regulator didn’t respond to GAO questions about whether additional training was required for those members to access an SEC system used to manage contracts.

The CFPB, meanwhile, confirmed various levels of access that DOGE associates had to eight agency systems. It also provided documentation — albeit a “limited” amount — that showed six DOGE members having received a privacy briefing, while another four finished security training.

But the bureau repeatedly pushed back on GAO’s efforts, telling the watchdog that its “requests for more information demonstrate a fundamental lack of understanding of federal executive personnel management” and that it was “imposing an undue burden on its operations,” per the report.

“According to CFPB, the bureau nonetheless provided us with information related to training completed by DOGE staff, but we were unsatisfied and sought to continue to request further information imposing an undue burden on its operations,” the GAO said. “CFPB’s comments are not consistent with the bureau’s policies and guidance on taking training, signing security agreements, and completing background agreements.” 

The SBA seemingly didn’t play ball with the GAO at all: The agency didn’t identify which systems DOGE was granted access to, nor did it explain to the watchdog why it wouldn’t address requests regarding IT security protocols.  

The VA was a bit more forthright, with agency officials telling the GAO that contractors and DOGE liaisons had standard access to systems. But the department didn’t share a list of those systems and didn’t tell the watchdog what level of access was granted to them.

Previous GAO inquiries into DOGE’s work across agencies proved a bit more fruitful. In an August report, the watchdog found that the Elon Musk-backed collective’s “Wall of Receipts” contained padded figures and baseless claims. A separate report that month detailed a lack of ethics training and financial disclosures among DOGE staffers.