DOJ Confirms False Claims Act Will Continue to Apply to Cybersecurity Cases

The Department of Justice (DOJ) continues to aggressively pursue civil cyber-fraud cases, reaffirming the federal government’s commitment to addressing vulnerabilities in contractor cybersecurity practices. In a recent development, the DOJ announced a $4.6 million False Claims Act (FCA) settlement with a Massachusetts-based company over cybersecurity deficiencies in its Department of Defense contracts.

The settlement, announced on March 26, stems from a qui tam complaint filed by a whistleblower who will receive approximately $850,000 of the settlement amount. The company must also pay an additional $198,000 for attorney’s fees and expenses as required by the FCA.

As part of the settlement agreement with the Boston U.S. Attorney’s Office, the company admitted responsibility for four significant violations that highlight critical compliance issues for any government contractor.

First, the company failed to implement required cybersecurity controls outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-171. These controls are designed to protect controlled unclassified information in non-federal systems and organizations. The company’s failures left its networks vulnerable to potential exploitation and data exfiltration.

Second, the company misrepresented its security control implementation status to the Department of Defense. Under Defense Federal Acquisition Regulation Supplement (DFARS) requirements, the company submitted a self-assessed score of 104 out of a possible 110 points for NIST compliance. However, a third-party consultant later determined the actual score was -142, indicating that only 22% of required controls were fully implemented. Despite learning of this discrepancy, the company waited nearly a year to correct its submission.

Third, the company failed to maintain consolidated written plans for its information systems as required by the Federal Risk and Authorization Management Program (FedRAMP). These plans should have described system boundaries, environments, security requirements, and connections to other systems.

Finally, the company used a cloud email hosting provider that was not contractually required to meet DFARS or FedRAMP requirements, nor did the company verify the provider’s compliance status. This oversight is particularly significant as the company used this cloud-based email system to exchange controlled unclassified information.

The case offers several important lessons for organizations working with government contracts. Companies must foster a cybersecurity culture where employee concerns are taken seriously. According to the complaint, the whistleblower—who served as the company’s Head of Security and Facility Security Officer—identified vulnerabilities “within weeks of arriving” in January 2021 and repeatedly raised issues with senior leadership before filing the qui tam complaint in January 2023.

The settlement also highlights the dangers of conducting security assessments without appropriate follow-through. While the company did engage a third-party consultant for a gap analysis, it failed to implement remediation plans in a timely manner, creating a documented record of known vulnerabilities that remained unaddressed.

Corporate governance issues also played a significant role. The complaint alleges institutional noncompliance and disregard for contractual obligations, with senior leadership viewing noncompliance as merely “a business risk.” This case underscores that cybersecurity risk assessment cannot be handled by IT departments alone but requires legal counsel involvement to properly qualify and quantify risks.

For government contractors, the evolving regulatory landscape demands vigilance. Several government agencies now require compliance with NIST control frameworks, and this trend is likely to expand. What begins as a government requirement often becomes a commercial expectation for handling sensitive information.

The case also emphasizes the importance of third-party vendor management. Companies must understand how data flows through their systems and ensure that all vendors handling sensitive information meet applicable regulatory requirements.

As cybersecurity regulations continue to evolve and enforcement actions increase, organizations must prioritize compliance to avoid similar investigations and settlements. This case serves as a stark reminder that cybersecurity deficiencies can lead to significant financial penalties and reputational damage, particularly for companies handling government contracts.