The U.S. Department of Justice (DOJ) has once again reinforced a critical message for the federal contracting community: Cybersecurity compliance is no longer simply a contractual obligation. It is increasingly becoming a False Claims Act enforcement priority that can expose government contractors to significant financial liability.

In a recently announced settlement, a defense contractor agreed to pay more than $500,000 to resolve allegations that it knowingly failed to comply with cybersecurity requirements incorporated into contracts with the Department of the Navy while continuing to submit claims for payment. The case serves as yet another reminder that federal agencies and enforcement authorities are actively scrutinizing contractor compliance with cybersecurity obligations, particularly those tied to safeguarding sensitive government information.

This latest enforcement action underscores a growing reality for companies operating in the defense industrial base. Cybersecurity failures can now create not only operational and contractual risk, but also substantial exposure under the False Claims Act.

The Government’s Cybersecurity Enforcement Focus Continues to Intensify

According to the DOJ, the contractor allegedly failed to fully implement required security controls under NIST Special Publication 800-171, the cybersecurity framework that governs how contractors must protect Controlled Unclassified Information (CUI) across nonfederal systems. The alleged compliance failures occurred over a period spanning nearly four years, during which the contractor continued performing under Navy contracts and submitted invoices for payment despite purportedly failing to implement required cybersecurity safeguards.

The contractor’s alleged deficiencies were identified during an assessment conducted by the Defense Contract Management Agency, which reportedly issued the contractor an assessment score of negative 170 under the Department of Defense’s cybersecurity scoring methodology. For context, scoring under the assessment framework ranges from negative 203 to positive 110, making a score this low particularly significant from an enforcement perspective. The government alleged that unimplemented security controls created material vulnerabilities that could have allowed exploitation of contractor systems or unauthorized exfiltration of sensitive defense information.

Why False Claims Act Exposure Is Expanding for Cybersecurity Violations

This settlement represents another example of the DOJ using the False Claims Act as a cybersecurity enforcement mechanism against federal contractors. Historically, cybersecurity compliance failures often resulted in contract disputes, negative contractor performance evaluations, cure notices, or potential suspension and debarment concerns. Increasingly, however, the government is framing cybersecurity deficiencies as fraudulent conduct when contractors certify compliance with contractual cybersecurity obligations while failing to satisfy those requirements.

The legal theory is straightforward. If a contractor agrees to comply with mandatory cybersecurity clauses, represents compliance to the government, and submits claims for payment despite known deficiencies, those invoices themselves become the basis for False Claims Act liability.

The DOJ has made clear that this enforcement theory remains a major priority. Assistant Attorney General Brett Shumate emphasized that contractors entrusted with sensitive defense information must strictly follow cybersecurity requirements and warned that the DOJ will continue investigating violations that place protected government information at risk.

Why NIST SP 800-171 Compliance Demands Immediate Attention

For defense contractors, the significance of this enforcement action extends far beyond the settlement amount. Most contractors performing work for the Department of Defense operate under contractual clauses requiring implementation of the security controls contained in NIST Special Publication 800-171. These requirements frequently appear through clauses such as DFARS 252.204-7012 and related cybersecurity provisions incorporated into defense contracts.

Contractors sometimes treat cybersecurity compliance obligations as technical requirements delegated entirely to internal IT teams or third-party managed service providers. This enforcement action demonstrates that government agencies increasingly view cybersecurity compliance as a legal and contractual certification issue capable of triggering fraud liability.

Even partial noncompliance can create substantial risk when contractors certify compliance, submit self-assessment scores, or accept contract payments without fully satisfying contractual cybersecurity requirements.

The Broader Federal Cyber Fraud Enforcement Landscape

This case arrives amid an increasingly aggressive federal enforcement environment focused on fraud, waste, and abuse involving government programs. The administration recently announced the creation of the Task Force to Eliminate Fraud and a new National Fraud Enforcement Division designed to strengthen oversight of fraud affecting federal programs. The DOJ specifically emphasized that False Claims Act enforcement will remain central to these anti-fraud efforts.

For government contractors, this signals that cybersecurity enforcement activity is unlikely to slow down. Federal agencies are increasingly coordinating with investigative bodies such as the Naval Criminal Investigative Service, the Defense Contract Management Agency, and specialized Department of Defense cybersecurity assessment teams to identify contractor compliance failures.

Key Takeaways for Government Contractors

Defense contractors should view this enforcement action as another clear indication that cybersecurity compliance can no longer be treated as a secondary administrative obligation. Contractors handling CUI should immediately reassess whether their organizations have fully implemented required security controls under NIST Special Publication 800-171, whether their System Security Plans accurately reflect actual implementation status, whether plans of action and milestones properly document known deficiencies, and whether internal certifications submitted to the government accurately reflect their real-world cybersecurity posture.

The DOJ continues signaling that cybersecurity-related False Claims Act enforcement will remain a significant risk area for companies operating in the federal marketplace. For defense contractors, the lesson is becoming increasingly clear. Cybersecurity compliance failures are no longer viewed merely as contract administration issues. They are now squarely within the government’s fraud enforcement crosshairs.

Companies that proactively evaluate their compliance posture now will be far better positioned than those waiting until regulators, investigators, or contracting agencies initiate scrutiny.