Defense Contractors Face False Claims Act Risks Under New CMMC Requirements

Defense contractors subject to Cybersecurity Maturity Model Certification (CMMC) requirements are now facing significant False Claims Act (FCA) liability risks following the program’s launch on November 10, 2025. The annual certification requirement creates recurring exposure that many contractors may have overlooked in their compliance planning.

The U.S. Department of Justice has already demonstrated its commitment to enforcement, settling seven cybersecurity fraud cases in 2025 alone. These settlements included groundbreaking actions: the first enforcement against a subcontractor and a case holding a business liable for cybersecurity violations by a federal contractor it acquired before the acquisition was finalized.

Under the regulations established in 32 C.F.R. 170.22, a senior executive must submit an annual affirmation in the Supplier Performance Risk System (SPRS) attesting that their organization “has implemented and will maintain implementation of all applicable CMMC security requirements.” This affirmation is mandatory upon achieving CMMC status, annually thereafter, and when closing out Plans of Action and Milestones (POA&Ms).

The critical component that creates legal exposure is simple but profound: without a current affirmation, contractors cannot be awarded contracts. The Defense Federal Acquisition Regulation Supplement (DFARS 252.204-7021) explicitly makes a “current” affirmation a prerequisite for both contract awards and option exercises.

“This is not merely an administrative checkbox,” explained one defense industry attorney familiar with the regulations. “It’s a recurring legal certification to the federal government that directly affects contract eligibility.”

For CMMC Level 1 compliance, only final status is permitted with no conditional status allowed. For Levels 2 and 3, contractors may hold conditional status for up to 180 days while closing out POA&Ms, but the affirmation requirement remains in effect.

The DOJ’s Civil Cyber-Fraud Initiative, launched in October 2021, signaled that the department would use the FCA as its primary enforcement tool against contractors failing to meet cybersecurity obligations. The initiative targets three specific behaviors: knowing failures to comply with cybersecurity standards, knowing misrepresentations of security practices, and knowing failures to report cyber incidents.

The enforcement theory is straightforward. When a contractor certifies compliance with cybersecurity requirements as a condition of payment or contract eligibility, and that certification is false, they have submitted a false claim under federal law. Penalties can include treble damages and substantial per-claim penalties.

The 2025 settlements reveal the government’s aggressive approach. In February, a managed care provider paid $11.25 million to settle allegations it falsely certified cybersecurity compliance in a TRICARE contract. In April, a defense contractor agreed to a $4.6 million settlement after allegedly submitting a false SPRS score—reporting a positive assessment when its actual score was negative 142.

Perhaps most concerning for the industry was a July settlement for $8.4 million where an acquiring company was explicitly named as “successor in liability” for a target’s pre-acquisition cybersecurity failures—violations that occurred years before the deal closed. Another July settlement for $1.75 million held both a contractor and its private equity owner liable for cybersecurity violations.

The FCA’s “knowing” standard is lower than many contractors realize. The law defines “knowingly” as actual knowledge, deliberate ignorance, or reckless disregard for the truth or falsity of information. This means a contractor that signs an annual affirmation without verifying compliance status, or ignores known gaps, may be accused of acting with “reckless disregard” sufficient for FCA liability.

Whistleblower provisions add another significant risk layer. Individuals who report FCA violations can receive between 15-25 percent of any recovery. The December 2025 settlement involving a supply chain subcontractor originated from a complaint filed by a former employee, highlighting how insiders with knowledge of compliance gaps can trigger investigations.

For companies acquiring defense contractors, the July successor liability settlement fundamentally changes due diligence requirements. Buyers evaluating targets with Department of War contracts or subcontracts should treat CMMC compliance as a core diligence workstream, even for companies that don’t primarily identify as defense contractors but participate in defense supply chains.

Industry experts recommend defense contractors take several immediate steps: treat affirmations as serious legal certifications, conduct internal gap assessments before affirming, document all remediation efforts, establish processes to monitor compliance changes, and address potential whistleblower risks through transparency and proper compliance.

“The CMMC affirmation requirement isn’t just another regulatory burden—it’s a legally binding certification with real enforcement consequences,” noted one cybersecurity compliance consultant. “Companies that treat this as merely an IT project rather than an enterprise risk management priority do so at their own peril.”