Cybersecurity compliance is no longer just a contractual obligation for government contractors. It is increasingly an enforcement priority.

In this in-depth conversation, Bart Daniel, Matt Austin, and David Yang examine how the Department of Defense’s Cybersecurity Maturity Model Certification requirements intersect with the False Claims Act and why that intersection is creating heightened litigation risk for contractors and subcontractors.

They discuss the current CMMC 2.0 landscape, upcoming implementation timelines, the continued importance of DFARS cybersecurity clauses, and how non-compliance can evolve into an FCA claim through express or implied certification theories. The conversation also explores the growing role of whistleblowers, the Department of Justice’s Civil Cyber-Fraud Initiative, and what “reasonable diligence” and good faith compliance efforts look like in practice.

For companies handling controlled unclassified information, certifying cybersecurity compliance, or performing work under federal contracts, these issues are no longer theoretical. Early assessment, documentation of compliance efforts, and proactive legal guidance can significantly reduce risk before scrutiny turns into an investigation.