GAO report GAO-16-501 reviewed high-impact federal systems at four agencies, OPM among them. It found OPM met the risk assessment requirement but only partly met requirements for security plans, control assessments and remedial action plans, and found access control, patching and contingency planning weaknesses across the agencies.
What this report is and is not
It is a GAO review of high-impact systems, not a postmortem of a specific intrusion. The GAO page itself does not describe the OPM breach, so this post sticks to what it states.
What GAO found for OPM
OPM met the requirement for risk assessments. It only partly met requirements for security plans, control assessments and remedial action plans.
Across the four agencies GAO found access control weaknesses, including gaps in system boundary protection, user authentication and audit monitoring, along with weaknesses in patching and in contingency planning.
Recommendations to OPM
- Update security plans for selected systems to address all high-impact controls, with a rationale for any control not implemented.
- Provide and track specialized security training for everyone with significant security responsibilities, contractors included. OPM partially agreed.
- Re-evaluate control assessments to ensure they test technical controls comprehensively. OPM disagreed and GAO kept the recommendation.
- Update remedial action plans to include funding source and completion dates.
GAO's page lists all four as closed and implemented, with its verification dates between 2019 and 2022.
Reading it as a practitioner
Three patterns are useful anywhere:
- A plan that omits a control without a stated reason is a gap you cannot defend.
- An assessment that tests paperwork but not technical settings gives false comfort.
- A remediation plan with no funding or date is a wish.
Checks you can run on your own program
- Pick your most sensitive system and read its security plan. Does it say what is not implemented, and why?
- Look at the last control assessment. Did it test settings and logs, or only policies?
- Open your remediation list. Does every item have an owner, a budget source and a date?
Evidence over assertion
Safeguard's compliance and evidence automation can keep plans, tests and remediation items connected to the controls they relate to, which makes the three checks above easier to repeat.
Why plans and assessments matter
Security plans and control assessments can look like paperwork, but they are how an organization knows what it has actually done. When a plan is partial, nobody can say which controls protect the most sensitive data. When an assessment skips technical testing, leaders believe controls work without proof. GAO's findings show that these basics are where reviews often find gaps, so they repay attention.
Quick check
Did GAO-16-501 investigate the OPM breach?
No. It is a review of security controls over high-impact systems at four agencies, one of them OPM.
Did OPM agree with every recommendation?
No. It partially agreed on training and disagreed on re-evaluating control assessments, according to the GAO page.
Sources
Last reviewed: 19 October 2026.
