Seven of Eight Open GAO Cloud Security Recs Sit on SaaS Systems

In May 2023, GAO made 35 cloud security recommendations (opens in a new tab) to Agriculture, DHS, Labor, and Treasury. By GAO's latest status updates, from July through September 2026, 27 were closed and 8 were still open, all at DHS and Treasury. Seven of those eight name a software-as-a-service system.

That pattern matters to any prime that delivers or operates a SaaS-based system for a civilian agency. The status notes also record what each agency sent GAO, and whether GAO judged it enough to close the item. Together, they read as a deliverables list.

Two Agencies Closed Everything

GAO's report, "Cloud Security: Selected Agencies Need to Fully Implement Key Practices" (GAO-23-105482), looked at 15 cloud systems against six key practices. The recommendations covered access authorizations, continuous monitoring, service level agreements, FedRAMP requirements, contract language, and incident response.

At DHS, the open items are the agency authorization for a SaaS system (opens in a new tab) and service level agreements that define performance metrics, how they are measured, and how they are enforced. At Treasury, all six open items concern two SaaS systems: requiring multifactor authentication, continuous monitoring on both systems, a review and risk analysis of the provider's FedRAMP package, and documented procedures for recovering from incidents. GAO lists the two incident recommendations as partially addressed.

Documents GAO Did Not Accept

Treasury's notes are the most useful part of the report for a capture team, because they show documents that were sent and didn't close anything.

In April 2025, Treasury sent GAO the customer responsibility matrix for one SaaS system. GAO kept the continuous monitoring recommendation open because the agency "did not provide evidence showing that the agency had monitored the security controls that are the agency's responsibility." It sent the same kind of matrix for the other SaaS system, and GAO kept the FedRAMP package recommendation open for lack of evidence that the agency "had performed a review and risk analysis."

The other open items follow the same pattern:

• A FedRAMP continuous monitoring guide did not show that anyone had reviewed the provider's monitoring deliverables.
• Documentation of authentication settings did not show that multifactor authentication was required.
• An incident response plan did not include the steps for recovering that specific SaaS system.

Each time, the agency sent the plan or the matrix, and GAO asked for a record that the work had been done on the named system.

What the 27 Closures Used

The closed recommendations show what GAO did accept:

• Authorization on file. Labor closed two authorization recommendations in September 2025 with its third-quarter CIO FISMA report, which documented that the provider's authority to operate was on file with the FedRAMP program office. DHS closed its infrastructure authorization by issuing the authorization and sending the letter to that office.
• Assessment records. Treasury closed a platform monitoring recommendation with its fiscal 2023 and 2024 assessment plans, which documented the controls reviewed and the results.
• Contract text. Treasury closed its service level agreement recommendation with a contract excerpt. A provider that misses its service level objectives can be required to redo work and lose available award terms.
• Review records. DHS closed an infrastructure monitoring recommendation after showing that its security team reviews the provider's deliverables and records each review in an agency system.

In each case the evidence was dated, tied to one system, and produced by a routine activity rather than written for the audit.

Why SaaS Is Where It Stalls

GAO's notes don't give a single reason. For DHS, the agency told GAO that its role on the FedRAMP Joint Authorization Board ensured the provider met the program's requirements. Our Technical Brief on the FedRAMP authorization recommendation on DHS's open list covers why a provider authorization doesn't replace the agency's own.

The open items share one feature. Each concerns the agency's side of a service a provider runs end to end. Account settings, monitoring reviews, and recovery steps for a SaaS product still belong to the agency, and those are the records GAO is still missing.

The same gap turned up again in June 2026. In GAO-26-108443 (opens in a new tab), across 8 cloud systems at four agencies, continuous monitoring was fully performed for 3.

FedRAMP is also changing the provider side. It launched its Consolidated Rules for 2026 (opens in a new tab) on June 25, 2026, mandatory for all stakeholders from January 1, 2027, and plans to sunset existing Rev5 authorizations by December 31, 2028 (dates as summarized by Crowell & Moring, a non-GAO source). Under FedRAMP Notice 0004 (opens in a new tab), 20x and Rev5 offerings share one designation, "FedRAMP Certified." Provider packages will change format. None of the eight open recommendations is about the provider.

Where It Lands in a Bid

For a SaaS deployment or operations task at DHS or Treasury, the open recommendations point to deliverables that an evaluator can check:

1. A dated record of each review of the provider's continuous monitoring deliverables, on a set cycle.
2. Assessment results for the controls the matrix assigns to the agency, not just the matrix.
3. Recovery steps written for that SaaS system, not only for the agency's incident response plan as a whole.
4. A record of the review and risk analysis of the provider's FedRAMP package, and an authorization on file.

Transition plans are where these can be dated. An incoming contractor that inventories every SaaS service in the boundary and confirms which ones have an agency authorization and monitoring records gives the agency a fixed point to start from.

The cost volume should carry this work too. Monthly reviews and annual assessments of customer-owned controls are recurring labor, and an offer that leaves them out is pricing a different job.

Where Avalon Fits

Avalon's ATO Process Facilitation white paper describes an evidence-first method. No implementation statement ships unless it traces to a named artifact, configuration export, or interview record. The customer responsibility matrix records which controls are inherited, shared, or owned, and each shared control gets evidence for the agency's half.

The plan set includes an incident response plan, and the handoff includes a continuous monitoring strategy under NIST SP 800-137 with a control assessment calendar. Avalon doesn't grant authorizations and is not a FedRAMP third-party assessor; the authorizing official makes the decision.

If SaaS deployment or cloud operations work at DHS or Treasury is in your capture plan, Avalon teams as the sub that builds the customer-side evidence these open GAO recommendations are still waiting for.