False Claims Act Emerges as Critical Cybersecurity Concern for Federal Contractors

Federal contractors face mounting pressure as the False Claims Act (FCA) increasingly becomes a powerful tool for enforcing cybersecurity compliance, adding another layer to an already complex regulatory landscape.

Originally created during the Civil War era, the FCA allows the U.S. government to pursue claims against entities that knowingly submit false claims to the government. The legislation also permits private citizens to file qui tam suits on behalf of the government, with whistleblowers receiving a portion of any recovery.

This enforcement mechanism has proven remarkably effective. The Department of Justice reported over $2.9 billion in FCA settlements and judgments in fiscal year 2024, alongside a record-setting 979 qui tam lawsuits filed by whistleblowers.

The robust enforcement is fueled by the FCA’s provision for treble damages and its expanding application to various types of fraud. While healthcare programs, military procurement, and pandemic assistance fraud cases have dominated headlines, cybersecurity has emerged as a significant new frontier for FCA enforcement.

In October 2021, the Biden administration launched the Civil Cyber-Fraud Initiative, specifically targeting government contractors and grant recipients who misrepresent their cybersecurity practices. Since then, the DOJ has pursued and settled multiple cybersecurity fraud cases across diverse industries, often resulting in multi-million dollar resolutions.

The scope of potential violations is notably broad. Organizations face FCA risk for failing to adhere to cybersecurity protocols outlined in government contracts, industry standards such as NIST or ISO frameworks, and applicable regulations. Even inadequate product security design and development can trigger scrutiny.

Contrary to common perception, a data breach is not necessary to initiate an FCA investigation. Additionally, enforcement is no longer confined to traditional FCA targets like healthcare and defense. Recent actions have involved higher education institutions, research facilities, consulting firms, technology companies, and even private equity firms investing in defense contractors.

The trend of utilizing the FCA as a cybersecurity enforcement mechanism appears likely to continue despite the change in administration. The DOJ and various federal and state regulators continue to impose additional cybersecurity requirements while building their cybersecurity expertise. In May 2025, the DOJ’s criminal division reaffirmed its focus on “waste, fraud, and abuse, including healthcare fraud and federal program and procurement fraud that harm the public fiscal.”

For contractors, navigating this evolving landscape requires close collaboration among stakeholders. Cybersecurity teams must work with IT, legal, executive leadership, and other relevant departments to ensure cybersecurity controls are accurately reflected in certifications and contracts.

Organizations should establish regular communication channels and develop repeatable processes for identifying and managing cybersecurity requirements throughout the contract lifecycle. This approach applies not only to direct government contracts but also to subcontracts with flow-down requirements and third-party providers that support contract performance.

Creating a transparent environment where employees feel empowered to raise cybersecurity concerns through established procedures can reduce the likelihood of whistleblower complaints. Maintaining current documentation of cybersecurity practices and improvement plans equips organizations to address potential complaints promptly.

External advisors with knowledge of an organization’s cybersecurity posture can provide valuable guidance on prioritizing risks based on the current threat landscape and enforcement climate. Their expertise becomes particularly crucial when responding to government information requests or seeking cooperation credit.

As federal cybersecurity requirements continue to evolve and enforcement remains aggressive, contractors must treat FCA compliance as a critical component of their overall risk management strategy, requiring ongoing attention and investment.