Federal Systems Fail as Agencies Face More Top-Down Rules

The U.S. Postal Service said it returned about 39% of items sent to its Mail Recovery Center. A USPS Office of Inspector General audit found the actual rate was less than 1%. That gap exposes how weak oversight and flawed records can shape decisions about people whose packages disappear.

What the Numbers Hide

Undeliverable items, which the Postal Service calls “dead mail,” go to the Mail Recovery Center. Staff open and sort them, look for packing slips and other identifying information, then inventory items to compare with customer searches for missing mail. Most items identified in the audit couldn’t be reunited with recipients. Staff eventually recycled, donated, discarded or sold them in public auction lots.

The audit found package volume had been underestimated by about four times. Staff weighed incoming material, then used a flawed estimation process that grouped unlike items and didn’t compare samples against other data. Spreadsheet errors led to double counting, and the figures came from a subset of a subset. Heidi Einsweiler, Director of Sales, Marketing and International Mail Audits, USPS Office of Inspector General, said those data problems could affect staffing and space decisions, targeted improvements, and vulnerability to fraud or theft.

The Postal Service also failed to develop a way to charge original shippers for return postage when commercial shippers and warehouses refused returned items. It hadn’t accounted for the cost of disposing of items at the center, either. Einsweiler said the Postal Service lost about $109 million in a little over two years. The service was evaluating automatic collection from original shippers and conducting a cost-benefit analysis of disposal fees.

Cloud Promises, Missing Capacity

Federal agencies have been directed toward multi-cloud systems, but Federal News Network commentary argued they often lack the engineers needed to make transitions between providers work. Agencies may depend on contractors, while system knowledge sits across three or four vendor teams. People who rely on public services—including benefits eligibility, permitting and case management—bear the risk when those arrangements fail.

On Aug. 20, scheduled fiber maintenance in Google Cloud’s us-west1 region reduced network capacity between data centers, and automated rerouting failed. More than two dozen services—including Compute Engine, Cloud Storage, Kubernetes Engine and Identity and Access Management—recorded elevated errors and provisioning failures. Google’s incident report listed stricter safety checks before routine maintenance and better automatic failover when capacity drops suddenly.

A cooling failure at an AWS data hall in Northern Virginia also shut down servers in the us-east-1 region. Temperatures exceeded operating thresholds, hardware shut itself down, and recovery continued into the following day. Neither provider collapsed, the commentary said. The automation meant to absorb disruptions failed.

The push toward multi-cloud followed the collapse of the Joint Enterprise Defense Infrastructure (JEDI) program and its replacement by the Joint Warfighting Cloud Capability program, which split defense cloud work among four providers. Yet moving between AWS accounts within the same provider, region and tools took eight to nine months at a previous company acquired by Tenable, according to the author. Identity, domain name systems, networking and storage depend on provider-specific systems, so teams must discover dependencies, sequence work and manage permissions.

Certification and Clearance Gates

FedRAMP’s Consolidated Rules for 2026 took effect July 4, 2026, with enforcement scheduled to start Jan. 1, 2027. The rules rename “FedRAMP authorization” as “FedRAMP Certification,” replace impact levels with Certification Classes A through D, and replace continuous monitoring with Ongoing Certification. Plans of Action and Milestones become a list of Accepted Weaknesses; vulnerability detection and response requirements expand, while JSON replaces Word and Excel templates.

The commentary said the same small teams responsible for cross-cloud failover must rebuild certification packages. FedRAMP will stop accepting new Rev5 certifications on June 11, 2027; existing Rev5 certifications remain active until at least the end of 2028. The author urged quarterly tests with real workloads and measured recovery times.

The Government Accountability Office denied Sawdey Solution Services Inc.’s protest of an Air Force rule requiring bidders to hold an active top-secret facility clearance when submitting proposals. Sawdey argued it could obtain approvals before work began, but the GAO said it found “no basis to question the reasonableness of the agency’s justification” and that Sawdey couldn’t guarantee it would quickly obtain approvals. The watchdog said relaxing the requirement could expose the agency to greater risk from other offerors.

The Defense Department is working on the broader bind: some companies may need a contract to begin the facility-clearance process, yet need a clearance to compete for classified work. The Defense Innovation Unit recently launched the Classified Access to Address Critical Technology (CLASS ACT) program, allowing some companies to start that process before the government is ready to buy their technology. Sharad Kumar, co-founder and CEO of FluidCloud, argued agencies should test whether they can move citizen-facing workloads and produce certification evidence during the move. The machinery keeps adding requirements. The test is whether people relying on it can still get service.