RSG #339: How to Audit Contractors Working Inside Secure Government Systems

Security clearance is not a technical certification, and a government contract is not a magic cloak of competence.

Government agencies rely on private contractors to build software, maintain cloud systems, manage networks, provide technical support, and sometimes work inside facilities where sensitive or classified information is handled. That arrangement can be necessary. It can also create a magnificent accountability maze in which the agency blames the prime contractor, the prime contractor blames a subcontractor, and the subcontractor quietly deletes the job advertisement that explained what workers were actually doing.

Citizens cannot inspect classified systems or demand operational security details. We can, however, audit the public contracting structure surrounding them. Contract awards, modifications, corporate records, job advertisements, inspector general reports, cybersecurity requirements, and congressional correspondence can reveal whether the government hired qualified people and bothered to supervise them.

Why This Matters Now

In July 2025, ProPublica revealed that Microsoft had used engineers based in China to help maintain Defense Department cloud systems. United States personnel with security clearances acted as digital escorts and entered commands supplied by the foreign engineers. ProPublica found that some escorts lacked the technical expertise needed to evaluate the work they were supervising.

The reporting did not establish that sabotage or espionage occurred. It exposed a vulnerability and an oversight failure. That distinction matters. Resistance work requires evidence, not a dramatic soundtrack and three unsupported accusations before breakfast.

Microsoft subsequently said it had stopped using engineering teams based in China for Defense Department cloud support. The Pentagon halted the arrangement, opened an investigation, ordered an outside audit, and tightened requirements for technology vendors. Congress later enacted a prohibition covering certain personnel based in China and other designated adversarial countries.

The scandal demonstrated a basic problem. A clearance establishes that a person has been found eligible to access certain information. It does not prove that the person can recognize malicious code, evaluate a cloud configuration, supervise an advanced engineer, or distinguish a legitimate repair from a digital booby trap wearing a help desk ticket.

Know What You Are Auditing

A SCIF is an accredited space used to handle Sensitive Compartmented Information. A classified network, a secure cloud environment, a contractor facility, and a system containing Controlled Unclassified Information are not automatically SCIFs. They operate under different rules.

Do not describe every protected government computer as classified. Do not claim that every contractor with a clearance works inside a SCIF. Determine what the public records actually establish, then use the correct term. Accuracy is especially important when government secrecy already makes the facts difficult to see.

Your audit should focus on unclassified information about the contract, personnel requirements, oversight structure, corporate relationships, and documented performance. Never seek passwords, network diagrams, access procedures, vulnerabilities, classified work descriptions, or the identity of personnel whose disclosure could create a security risk.

Step by Step Guide

Step One: Define One Precise Audit Question

Begin with a question that can be answered using public evidence. Ask who performed a particular service, whether required qualifications appeared in the contract, whether subcontractors were disclosed, or whether the agency documented its supervision.

Do not begin with “Is this contractor spying?” That is a conclusion hunting for evidence. A stronger question is, “What technical qualifications and supervision requirements applied to the personnel maintaining this system?” One question creates an investigation. The other creates a social media migraine.

Step Two: Identify the Agency, Program, and Prime Contractor

Write down the agency, program name, contractor’s legal name, known brand names, contract number, award identifier, and approximate period of performance. Search the company through SAM.gov to confirm its legal identity and Unique Entity Identifier.

Corporate branding can obscure ownership changes, subsidiaries, and divisions. Record every verified variation of the name. Do not assume two similarly named companies are the same entity.

Step Three: Find the Contract Award

Search SAM.gov contract award data by contractor name, agency, award identifier, product or service code, and date. Public award searching moved from the old Federal Procurement Data System interface into SAM.gov in February 2026.

Record the obligated amount, potential value, awarding office, performance period, competition type, description, product or service code, and every modification number. A large potential ceiling does not mean the contractor received that full amount. Use actual obligations when describing money already committed.

Search USAspending.gov as a second source. Compare the results because one system may present relationships or transactions more clearly than the other.

Step Four: Locate the Solicitation and Attachments

Search SAM.gov contract opportunities using the solicitation number, award number, program name, and distinctive language from the award description. Look for the performance work statement, statement of objectives, amendments, questions from bidders, required labor categories, and security clauses.

Preserve public documents as soon as you find them. Record the title, date, source address, and access date. An amended solicitation may reveal that a qualification disappeared, a requirement weakened, or an entire responsibility migrated into an attachment that is no longer available.

Step Five: Map the Subcontractor Chain

The company receiving the federal award may not employ the people performing the work. Search SAM.gov subcontract reports, USAspending subaward data, corporate announcements, staffing company pages, court records, and public job listings.

Create a simple chain showing the agency, prime contractor, subcontractor, staffing company, and worker role. Label every relationship as confirmed, reported, or unverified. Never turn a possible connection into a factual one simply because the names fit neatly into your chart.

Step Six: Compare Job Advertisements With Contract Requirements

Search for public advertisements containing the contractor name, program name, work location, clearance level, software platform, and job title. Look at required education, experience, certifications, duties, pay, and supervision responsibilities.

The crucial question is whether the advertised worker could realistically perform the oversight promised by the contractor. If a position requires a clearance but treats relevant technical knowledge as merely preferred, preserve that language. A clearance is valuable, but it does not magically install cloud engineering expertise into a person’s brain.

Do not publish names, personal contact details, or information that could expose individual workers. Audit the company’s staffing model, not the receptionist’s private life.

Step Seven: Separate Clearance From Competence

Create two columns. In the first, list access requirements such as citizenship, clearance level, background investigation, and required security training. In the second, list technical requirements such as programming languages, cloud certifications, incident response experience, or system administration skills.

Now compare them. Could the person responsible for supervising technical work understand the commands, code, or configuration being reviewed? Did the contract require that ability? Did the job advertisement require it? This comparison can expose a system built around formal access eligibility while treating actual comprehension as an adorable optional accessory.

Step Eight: Examine Cybersecurity Requirements

Determine whether the contract involves Federal Contract Information, Controlled Unclassified Information, classified information, or another protected category. Review the referenced Federal Acquisition Regulation and Defense Federal Acquisition Regulation Supplement clauses.

The Defense Department is phasing in the Cybersecurity Maturity Model Certification program. A March 2026 Government Accountability Office review found that implementation planning addressed six of seven major strategic planning elements but had not systematically addressed important external factors that could interfere with the program.

Certification is evidence that specified requirements were assessed. It is not proof that every employee is competent or that every control worked perfectly every day. Record what the certification covers, who performed the assessment, and when it expires.

Step Nine: Search the Oversight Record

Search Oversight.gov using the contractor, agency, program, and contract number. Then search the relevant agency inspector general and the Government Accountability Office.

Look for audits, evaluations, open recommendations, corrective action plans, suspension decisions, data breaches, False Claims Act cases, and prior performance findings. A past allegation is not a conviction. A settlement is not automatically an admission. Describe the official disposition precisely.

Step Ten: Request the Unclassified Oversight Documents

If the public record remains incomplete, submit a focused records request. Ask for the unclassified portions of the quality assurance surveillance plan, contractor performance assessments, staffing qualification requirements, corrective action notices, security compliance summaries, relevant correspondence, and records identifying disclosed subcontractors.

Request segregable portions if some material is protected. State that you are not seeking classified information, system credentials, technical vulnerabilities, network diagrams, or operational security procedures. This makes the legitimate public interest clear while reducing the agency’s opportunity to pretend you requested the launch codes.

Step Eleven: Build an Evidence Matrix

For every finding, record the claim, source, document date, relevant language, confidence level, and unanswered question. Separate facts from reasonable inferences.

For example, a public job advertisement may establish what an employer requested from applicants. It does not prove that every person hired possessed only those minimum qualifications. A contract may require supervision. It does not prove that supervision occurred. Write what the evidence proves and stop where it stops.

Step Twelve: Send the Findings Where They Can Matter

Prepare a concise evidence packet containing a summary, timeline, contractor chain, contract identifiers, documented concerns, unanswered questions, and links to every public record. Send it to the relevant inspector general, congressional oversight committee, contracting office, or independent investigative newsroom.

The Defense Department Inspector General Hotline accepts reports involving fraud, waste, abuse, and violations connected to Defense Department programs. Anyone may submit a complaint. Do not include classified information in an ordinary online submission.

The Red Flags That Deserve Attention

Watch for technical oversight roles requiring a clearance but little relevant experience. Notice undisclosed subcontractors, vague labor categories, unusually low pay for complex security work, missing contract attachments, repeated sole source modifications, qualifications weakened after award, and contractors supervising their own compliance without meaningful government verification.

One red flag does not prove misconduct. Several documented red flags can justify a formal audit, records request, or congressional inquiry.

Keep the Investigation Responsible

Do not test a government system, contact workers for credentials, probe infrastructure, publish facility details, or encourage anyone to remove information from a secure environment. Public interest investigation does not require becoming the security incident described in next quarter’s inspector general report.

Protect individual workers unless their identities are necessary, already public, and relevant to official responsibility. Focus on the decisions made by agencies and corporations. The person earning eighteen dollars an hour did not design the national security contracting system. Someone much better paid did that.

Closing RK Thoughts

Secure government systems are only as secure as the contracts, workers, supervisors, and oversight surrounding them. A clearance cannot replace competence. A corporate promise cannot replace verification. A classified label cannot excuse an agency from explaining how taxpayer money was spent and whether the people performing sensitive work were properly qualified.

The public may not be allowed inside the secure room. We can still inspect the invoices, staffing promises, subcontractor chain, audit reports, and policy failures piled outside its door. Secrecy protects legitimate national security information. It should never protect lazy contracting from accountability.