Cybersecurity Lapses Can Lead to False Claims Act Liability

Key Takeaways

• Cybersecurity compliance is a core contractual obligation when working with the government, not an optional best practice
• False Claims Act risk is rapidly expanding in the cybersecurity space
• The Cybersecurity Maturity Model Certification program (CMMC) is transforming the defense contracting landscape
• Even without a data breach, defense contractors may face False Claims Act liability for falling short of their cybersecurity obligations.
• Cybersecurity obligations flow down the contracting chain, and liability for lapses can flow upwards.

Does your business’s government contract include cybersecurity obligations? Are you a subcontractor with access to government data? Cybersecurity compliance in government contracts is no longer a patchwork of improvised protocols governed by an honor system. Enforcement actions by the government are coming proactively and no longer just in the wake of a data incident or breach. Explicit information technology and cybersecurity expectations are now baked into government contracts and more detailed certifications of compliance are required, ushering in a heightened risk for potential False Claims Act liability.

In 2025, the Department of Justice (DOJ) aggressively pursued False Claims Act enforcement actions for cybersecurity lapses by government contractors and insisted on the imposition of significant penalties in settlements.

• Raytheon agreed to pay $8.4 million to settle allegations of failing to implement cybersecurity controls on an internal system used to perform unclassified work on contracts and subcontracts with the Department of Defense (DOD).
• MORSECORP paid $4.6 million to settle allegations of falsely certifying compliance with cybersecurity requirements in their contracts with the Departments of the Army and the Air Force involving their use of a third-party company to host emails without appropriate security, and failure to develop a consolidated written plan for information systems security.
• Illumina Inc. paid $9.8 million to resolve False Claims Act allegations relating to cybersecurity vulnerabilities in the genomic sequencing systems it sold to government agencies ranging from the Department of Health and Human Services, the Department of Energy, to the Smithsonian Institute.
• Georgia Tech Research Corporation agreed to pay $875,000 after certifying compliance but failing to install, update, or run antivirus or antimalware tools on computers in the lab where sensitive cyber-defense research was being conducted for DOD.
• Hill ASC Inc. paid at least $14.75 million after billing the General Services Administration for information technology services performed by personnel who were not qualified.

Contractors working with any government agency can expect these enforcement actions to continue and escalate as cybersecurity standards become more refined, and as the government’s concern for safeguarding its sensitive information remains a top priority.

Beginning November 2025, the Department of War (DoW)’s long-awaited Cybersecurity Maturity Model Certification program (CMMC) began its phased implementation into DoW solicitations and contracts. See 32 C.F.R. Part 170. CMMC applies throughout the defense contracting chain—covering contractors, subcontractors, and even sub-subcontractors that handle DoW data. CMMC creates three tiers of cybersecurity certification, each corresponding to the graduating level of sensitivity of the data involved.

• CMMC’s Level 1 relates to data defined as “Federal Contract Information (FCI),” which is any non-public information provided by or generated for the government under a contract to deliver a product or service to the government. CMMC Level 1 certification requires baseline cybersecurity hygiene practices, an annual self-assessment which is recorded in the Supplier Performance Risk System (SPRS), and an annual affirmation of compliance submitted to the government by a senior official for the business.
• CMMC Level 2 involves data defined as “Controlled Unclassified Information (CUI)” and requires alignment with National Institute of Standards and Technology (NIST) standards. Level 2 certification requires assessment by a CMMC Certified Third-Party Assessor Organization (C3PAO) every three years and annual affirmations of compliance.
• The most stringent certification, CMMC Level 3, relates to critical DoW programs, requires compliance with even more NIST standards, with government-led assessments by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) every three years and annual affirmations of compliance.

 

The phased implementation of this regulation began in November 2025 and is currently focused on CMMC Levels 1 and 2 self-assessments. Level 2 third-party certifications will be the focus in the second phase in year two. Level 3 certifications will be the focus in the third phase in year three. In the fourth phase, DoW’s goal is for all contracts and solicitations to include CMMC Level requirements as a condition of contract award.

No matter the applicable CMMC level, any certification to the government that cybersecurity requirements were met when they were not met will raise serious False Claims Act risk.

Credit: U.S. Department of War, Chief Information Officer, available at https://dodcio.defense.gov/cmmc/About/ (last accessed 3/9/2026).

A contractor seeking payment from the government for the goods and services they provided must certify compliance with the applicable cybersecurity requirements. Falling short of these requirements—which can be highly technical and expensive to comply with—could result in the government deeming the certification false and could expose the contractor, and any partnering sub or prime-contractors, to False Claims Act liability.

The teeth of the False Claims Act are the potential penalty of treble damages (three times the government’s loss). Measuring damages for cybersecurity lapses where there is a data incident or breach is usually tied to the harm caused. Where there is no data incident, damages may be valued at the cost of the foregone compliance measures. The DOJ has also exercised its prerogative to settle False Claims Act cases for cybersecurity lapses based upon a company’s ability to pay.

What can you do as a government contractor?

1. Work with counsel to fully understand your contract’s information technology or cybersecurity requirements and the nature of the data you will have access to or may create for the government’s use. Identify what safeguards you have in place, determine their sufficiency to meet the cybersecurity requirements under your contract, and rectify any lapses immediately. If you partner with a subcontractor or a prime-contractor, you should be proactive in understanding their data security competencies and challenges. Be aware that cybersecurity requirements in a government contract will flow to or from a sub or prime-contractor, along with liability for any noncompliance, allowing the risk of potential False Claims Act liability to be shared by all parties. A detailed contract review with counsel, under privilege, may be a smart measure to avoid the potential catastrophic risk attendant to a False Claim Act enforcement action.
   
   
2. If you identify a cybersecurity lapse, treat it as a potential incident of noncompliance and seek advice on next steps from an experienced legal team. Certifying compliance to the government when you know of the lapse could constitute a False Claims Act violation.  Do not certify compliance if you are not sure of your business’s compliance. Remember that involving counsel early in your investigation offers the protection of attorney-client privilege.
   
   
3. Establish a regular cadence of compliance checks. Cybersecurity compliance is not a one-time check box for government contractors. It is an ongoing, evolving obligation. The security measures required of government contractors are increasingly technical and expensive to implement. Annual risk assessments and working with experienced cyber counsel is a good way to do this.
   
   
4. Be mindful of False Claims Act risk from the beginning. Even at the early stage when submitting a bid, take note of the minimum required CMMC level (or other cybersecurity requirements) as a condition of the award. A company should appropriately budget for the cost of the cybersecurity measures the contract will require.

The HSE Government and Internal Investigations team is well-positioned to provide guidance in regard to these risks, and the HSE Privacy and Data Security team can help with privileged incident investigations and proactive risk assessments.