Two-thirds of a batch of General Services Administration assisted-acquisition contracts carried the wrong security classification, and the agency's own inspector general says the fix is still incomplete. In an implementation review issued July 20, 2026, the GSA Office of Inspector General reported that the Federal Acquisition Service's Office of Assisted Acquisition Services reviewed 479 Level 2 contracts and reclassified 321 of them — 67 percent — as Level 3, meaning contracts that may generate classified deliverables or require cleared contractor personnel had been coded as if they did not. When the OIG then pulled its own sample of 10 Level 2 contracts active in March 2026, it found 4 of them, or 40 percent, still misclassified.

Background

The review, Assignment No. A260034, tracks corrective actions from an earlier OIG audit, Report No. A230065/Q/3/P24001, issued September 16, 2024, which examined how AAS oversees and administers contracts with classified elements. AAS is not a peripheral GSA operation: the 2024 audit recorded FY2023 AAS revenue of more than $16 billion, over 48 percent of GSA's total revenue. AAS buys on behalf of other federal agencies, so the classification status of its portfolio determines which acquisitions get extra scrutiny and which contractor staff need clearances.

The original findings were blunt. The OIG sampled 60 Level 2 contracts active in August 2023 and found 55 — 92 percent — were not accurately classified under AAS's updated definitions, and that all 55 should have been Level 3. AAS had revised those definitions in May 2023, but the audit found contracting personnel were largely unaware of the change and had never been directed to review existing contracts against it. The audit flagged a second problem: AAS policy did not require contracting officers on Level 3 contracts to hold adequate security clearances. An uncleared contracting officer cannot address contract issues involving classified information and must identify another contracting officer with the requisite clearance to handle them — a handoff the OIG said could impair the assigned officer's responsibility for the contract.

The 2024 audit made six recommendations: review all active Level 2 contracts for correct classification; consolidate classification guidance; update monitoring controls; add edit-history and edit-permission controls to the ASSIST contract system; require clearances for Level 3 contracting officers; and train personnel. The Acting FAS Commissioner concurred with all six.

Key Details

The July 2026 review found AAS did not fully implement corrective actions for two of those recommendations. Recommendation 1 required a review of every active AAS Level 2 contract to confirm the correct security classification. Recommendation 3b required AAS to verify compliance with classification policies during the internal contract reviews it already conducts.

On Recommendation 1, AAS did substantial work. Its business units and its Operational Support Office Acquisition & Governance reviewed the 479 Level 2 contracts and moved 321 to Level 3. AAS also reported that its FY2025 Bi-Annual Full File review covered 80 contracts and found only 3 misclassified — a result suggesting the problem had largely been cleared.

The OIG's own testing said otherwise. Sampling 10 AAS Level 2 contracts active in March 2026, the OIG found 4 were not accurately classified under the current AAS definitions. AAS agreed that all four should have been Level 3 and updated the records in ASSIST. An OSO A&G Sector Director explained that staffing shortages and personnel turnover during the implementation of updated guidance had delayed updating ASSIST to reflect proper classification levels.

Advertisement

The tiers come from AAS Operational Notice 2025-001, effective August 11, 2025. Level 2 covers contracts where secure facility access is required but access to classified information or systems is not, and where no documents or deliverables are classified. Level 3 — Classified Elements for Performance — covers contracts where some post-award documents or deliverables may be classified and where some or all contractor personnel must hold appropriate security clearances. The line between the tiers is the line between a badge-and-escort arrangement and a cleared-workforce requirement.

The downstream consequence makes the coding error more than paperwork. AAS defines contracts as large, highly complex, or sensitive based on monetary value and various other factors, and the contract security classification level is one of them. Once an acquisition meets that definition, it is subject to a Program Management Office portfolio review — the additional oversight AAS built to manage the risks of its biggest and most sensitive work. The OIG's original finding was precisely that inaccurately classified contracts are not subject to those reviews.

AAS must submit a revised Corrective Action Plan for the two open recommendations to the OIG and to GSA's Audit Management Division by August 19, 2026. The AAS Assistant Commissioner agreed with the finding.

What It Means for Contractors

Contractors holding AAS-administered work should assume their contract's classification level may change without a competitive event. A move from Level 2 to Level 3 is an administrative correction inside GSA's system, but it reaches the contractor as a personnel and process requirement: some or all staff on the effort may need clearances, and deliverables handled as unclassified may need to be produced, stored, and transmitted as classified material. Companies that staffed a Level 2 award with uncleared personnel because the contract said no classified information was involved now face a mismatch that is not of their making but is theirs to resolve.

The practical step is to verify rather than assume. Ask the contracting officer what classification level the contract currently carries in ASSIST, whether it has changed since award, and whether the contract's documented security requirements match that level. With 321 contracts already moved and the OIG still finding errors in a March 2026 sample, a contractor's own file is not a reliable record of where GSA has the contract coded today.

Pricing and staffing plans deserve a second look. Clearance sponsorship, cleared-personnel labor rates, and secure storage or processing capability all carry cost a Level 2 bid would not have priced. Where a reclassification materially changes performance requirements, open that conversation with the contracting officer early rather than absorb the cost quietly.

Companies holding or pursuing AAS work should also expect classification to be checked more often. The open recommendations push AAS to build classification verification into the internal contract reviews it already runs, so the question is likelier to be revisited during administration than settled once at award. The staffing shortages AAS cited to the OIG suggest that verification will stay uneven past the August 19 deadline, so contractors carrying Level 2 awards with any classified adjacency should raise the question themselves rather than wait for GSA to reach their file.

Sources