OPM’s 2M-Worker NDA Won't Stop Leaks Without DLP and Zero Trust

For cybersecurity teams, the Office of Personnel Management’s new plan to fight leaks with a broad nondisclosure agreement feels like a page from a 1990s playbook. While NDAs are standard in corporate boardrooms, they do nothing to monitor or stop an insider from copying files to a USB drive or exfiltrating data through a cloud app. The proposal, covering 2 million workers, highlights a persistent disconnect between policy-makers and the technical controls actually needed to secure government information.

In mid-July 2026, the Office of Personnel Management (OPM) floated a proposal to require up to 2 million federal civil servants to sign a broad nondisclosure agreement (NDA) aimed at curbing government leaks. The initiative, championed by OPM Director Scott Kupor, a former venture capital and technology executive, has been met with substantial skepticism from legal and cybersecurity experts alike. While NDAs are standard in the private sector, the government’s unique obligation to balance secrecy with constitutional rights and existing statutory frameworks makes this proposal far more complex than a simple paperwork exercise.

“

A 2025 report by the Ponemon Institute indicated that 60% of data exfiltration incidents involve insiders, yet only 12% of organizations believe their legal agreements significantly reduce insider risk.

The NDA’s language is remarkably expansive. It covers all “non-public, confidential, or proprietary information, whether or not marked as such,” encompassing any “sensitive, pre-decisional or deliberative material.” This vagueness is troublesome because it could chill legitimate whistleblowing and routine information sharing, functions protected by the First Amendment and various civil service laws. Kupor argues that “the federal government should not be held to a lower standard,” but critics counter that the existing mesh of laws—including the Espionage Act, various classification regulations, and already mandatory NDAs like Standard Form 312 for those handling classified data—already provides a comprehensive legal framework. The new NDA would add a redundant, and potentially conflicting, layer.

From a cybersecurity standpoint, the proposal fundamentally misunderstands the nature of insider threats. Leaks are not solely a matter of insufficient contract language; they are often driven by ideology, disgruntlement, or simple negligence—none of which a signature on a document will deter. A 2025 report by the Ponemon Institute indicated that 60% of data exfiltration incidents involve insiders, yet only 12% of organizations believe their legal agreements significantly reduce insider risk. The federal government, with its vast repositories of sensitive data, is a prime target. Relying on an NDA without robust technical controls—such as data loss prevention (DLP) systems, user and entity behavior analytics (UEBA), and least-privilege access policies—is akin to placing a “trespassers will be prosecuted” sign on an unlocked door. For CISOs, the proposal is a reminder that insider threat programs must be built on a foundation of zero trust architectures, continuous monitoring, and robust access controls. NIST SP 800-53 already recommends controls like auditing of privileged actions and data exfiltration detection, yet many agencies lag in implementing them. An NDA adds a checkbox compliance item but does not shift the security maturity needle.

Moreover, the voluntary nature of the NDA—agencies may or may not adopt it—creates an inconsistent security posture. In cybersecurity, heterogeneity in policy enforcement is a known vulnerability vector; adversaries exploit gaps between departments. Without a unified, mandatory standard backed by technical enforcement, the NDA risks becoming a hollow gesture that confuses employees about what constitutes a breach. The overlap with whistleblower protections set forth by the Whistleblower Protection Enhancement Act and Intelligence Community directives raises the specter of legal challenges that could tie up enforcement for years. The First Amendment considerations are not trivial. Courts have long held that government employees do not surrender their free speech rights when entering public service, as established in Pickering v. Board of Education (1968). Broad NDAs that restrict discussions of unclassified but ‘pre-decisional’ material could be found unconstitutional if they unduly burden speech on matters of public concern, wasting time and resources that could have been directed at actual security improvements.