Cyber security and the False Claims Act: risks, rules and defences

December 2026 | SPOTLIGHT | RISK MANAGEMENT

Financier Worldwide Magazine

December 2026 Issue

Cyber security is no longer just an IT issue; for companies doing business with the government, it is now a source of False Claims Act (FCA) liability.

Since launching its Civil Cyber-Fraud Initiative in October 2021, the Department of Justice (DOJ) has used the FCA to pursue contractors and suppliers that allegedly misrepresent their compliance with federal cyber security requirements.

Many of these cases began with whistleblowers – in FCA parlance, ‘relators’ – often current or former IT security personnel. Meanwhile, the requirements themselves have been shifting through the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) programme, new obligations for federal contract recipients, and proposed government-wide rules, such as the FAR Controlled Unclassified Information (CUI) Rule.

The gap between government-facing representations and actual security practices drives cyber security FCA exposure. A security deficiency can become a fraud allegation when a company seeks federal funds while knowingly making, or causing, a materially false or misleading representation about its compliance.

That exposure extends beyond defence contractors to universities, healthcare administrators, manufacturers and, where their own conduct supports liability, owners and investors. A successful cyber attack is not a prerequisite.

How cyber security failures become FCA cases

Cyber security FCA cases generally involve three different but often overlapping theories.

First, false certification. A company expressly or impliedly misrepresents its compliance with an applicable cyber security requirement, such as assessment scores and compliance affirmations, in an existing government contract.

Second, fraudulent inducement. A company obtains an award through a material misrepresentation about its security posture. If the elements of fraudulent inducement are established, subsequent claims under the resulting contract may be actionable, even when the underlying work was properly performed.

Third, misleading payment requests. A payment claim may be actionable when it makes specific representations about the goods or services provided but omits noncompliance that renders those representations misleading half-truths.

Nor is liability limited to entities that bill the government directly. A subcontractor, supplier or even a complicit third-party auditor may ‘cause’ or conspire with a prime contractor to submit false claims.

Recent developments create additional exposure

The DOJ’s Civil Cyber-Fraud Initiative uses the FCA to promote cyber security compliance by holding government contractors and grantees accountable when they knowingly violate applicable cyber security requirements.

From the outset, the DOJ identified three enforcement priorities: (i) knowingly providing deficient cyber security products or services; (ii) knowingly misrepresenting cyber security practices or protocols; and (iii) knowingly violating obligations to monitor and report cyber security incidents and breaches. That focus has continued under the current administration.

In addition, three recent regulatory developments make good faith efforts toward accurate compliance with cyber security obligations critically important.

Phase one of the multi-phased CMMC programme took effect in November 2025. It requires covered contractors to conduct structured self-assessments and affirm their continuing compliance annually. Each affirmation is a discrete, recurring representation to the government, and therefore a potential basis for FCA liability.

On 13 July 2026, however, the Department of Defense (DoD) suspended phase two of CMMC, which would have required contractors to obtain third-party assessments beginning on 10 November 2026, and launched a 60-day review of the programme. In the meantime, however, all phase one self-assessment requirements remain operative.

Contractors also remain obligated to safeguard covered defence information under the Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, while the DoD will continue to enforce the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2 through self-assessments and select government-led assessments. Consequently, more of the compliance record will rest on companies’ own representations, further heightening FCA enforcement risk.

The 2024 revisions to the Uniform Guidance for all federal awards (including grants) require recipients and subrecipients to “take reasonable cybersecurity and other measures” to safeguard protected personally identifiable information and other sensitive information. Separately, the guidance requires applicants and recipients to disclose promptly, in writing, credible evidence of an FCA violation in connection with a federal award.

Changing standards and reporting rules

The applicable version of a cyber security standard matters. DFARS 252.204-7012 remains tied to NIST SP 800-171 Revision 2, even though NIST published Revision 3 in 2024. The FAR Council’s 23 June 2026 proposed rule on CUI, however, would adopt Revision 3 for civilian contracts and thereby impose new CUI incident-reporting obligations going forward.

Similarly, the Cybersecurity and Infrastructure Security Agency has not finalised its regulations under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA). Once effective, CIRCIA will require covered entities in critical infrastructure sectors to report covered cyber incidents within 72 hours of reasonably believing one has occurred, and to report ransom payments within 24 hours, with supplemental reports as new information emerges.

Across these developments, the threshold questions are the same: what does the particular award require, which systems and information fall within its scope, and what has the company represented about compliance?

What recent enforcement teaches

Most cyber security FCA matters end in settlements that resolve allegations without admissions of liability or judicial findings. While not precedent, the settlements outlined below illustrate which facts are likely to attract enforcement attention.

Contradictory evidence can undermine certification. In one recent settlement, defence contractor MORSECORP Inc. reported a near perfect score of 104 out of 110 for its security controls under NIST SP 800-171. Later, however, an outside consultant informed the company during an unprivileged cyber security assessment that its actual score was minus 142, with only about 22 percent of the controls implemented. According to the government, MORSECORP did not correct its posted score until three months after receiving a subpoena. In March 2025, the company paid $4.6m to resolve these allegations.

Similarly, Health Net Federal Services and its parent, Centene, paid $11.25m in February 2025 to resolve allegations that, between 2015 and 2018, Health Net failed to meet required cyber security controls and falsely certified compliance in annual reports required under its TRICARE contract. The DOJ alleged that the company failed to timely scan for and remedy known vulnerabilities and ignored reports of cyber security risks from third party security auditors and its own internal audit department.

Decentralised systems and supply chains can create scope problems. Research institutions face distinctive challenges because covered information may reside in laboratories and systems that operate outside centralised IT functions. In October 2024, one university paid $1.25m to resolve allegations that it failed to implement required controls and adequately carry out corrective action plans under 15 DoD and NASA contracts and subcontracts. Another university similarly paid $875,000 in September 2025 after the government alleged that a research lab lacked a system security plan and antivirus protection and that a campus-wide assessment score did not reflect the covered systems.

Exposure extends beyond traditional defence compliance. Illumina, for example, paid $9.8m in July 2025 to resolve allegations that it sold genomic sequencing systems with software vulnerabilities to federal agencies, and misrepresented the systems’ adherence to cyber security standards. That same month, Aero Turbine and its private equity owner, Gallant Capital Partners, similarly paid $1.75m to resolve allegations involving missing controls and access to sensitive defence information by a foreign software vendor.

Meaningful limits: applicability, knowledge and materiality

Heightened enforcement in this space, however, does not spell certain doom for FCA defendants, as the government must still prove falsity, materiality and ‘knowledge’ of falsity.

The FCA reaches only claims or statements that are false or fraudulent. A claim may be either factually false – for example, a posted assessment score that misstates which controls were implemented – or legally false, because it expressly or impliedly certifies compliance with a requirement the company has not met.

The FCA requires actual knowledge, deliberate ignorance or reckless disregard; negligence is not enough. Ignored internal warnings can establish scienter, while documented, good-faith technical judgments can defeat it.

An actionable false claim must also be material to the government’s payment decision. The government’s general interest in cyber security, however, does not establish that a particular deficiency mattered to a particular payment decision.

Most recently, in United States ex rel. Pannek v. Archer Daniels Midland Co., a qui tam action in which the DOJ declined intervention, the court dismissed claims that Archer Daniels Midland (ADM) misrepresented its cyber security practices in obtaining federal funding. Although the relator plausibly alleged that the cited regulations applied, the court held that he failed to allege facts showing that the government attached weight to ADM’s cyber security practices in its funding decisions.

Practical implications

Cyber security FCA risk is not solely a technical problem. It is also a matter of governance, representations and careful risk mitigation.

A disciplined, proactive compliance process should include: (i) mapping requirements by award, entity, system and standard version; (ii) providing technical evidence (not merely attestations) that support each representation; (iii) escalating assessment findings that contradict prior representations; (iv) promptly evaluating whether correction, notification or disclosure is required or advisable; (v) reviewing supply chain compliance and flow-down obligations; and (vi) preserving contemporaneous reasoning, remediation records and government communications.

In addition, companies can further reduce their FCA exposure by having outside counsel with actual technical competency direct sensitive cyber security assessments, retain and supervise any technical consultants, and oversee the resulting remediation, so that candid findings and gap analyses are developed under the attorney-client privilege and work-product doctrine.

The current administration has made FCA enforcement a high priority, and given its prioritisation of national security-related violations, cyber security-related FCA enforcement is likely to be at the vanguard of this effort. To minimise this heightened risk, companies must take care that government-facing statements accurately reflect actual security practices and known deficiencies.

Evolving CMMC requirements, grant obligations and newly proposed rules make coordination among security, contracting, legal and executive leadership essential. Assessing and remediating gaps under privilege, with outside counsel who understand both the law and the technology, is one practical way to close that gap before the government finds it. And when allegations are made, a timely evaluation of possible defences and aggressive advocacy before the government is critical.

Patrick Linehan and Michael Gruden are partners and Emma Howard is an associate at Steptoe. Mr Linehan can be contacted on +1 (202) 429 8154 or by email: plinehan@steptoe.com. Mr Gruden can be contacted on +1 (202) 429 1306 or by email: mgruden@steptoe.com. Ms Howard can be contacted on +1 (202) 429 1368 or by email: ehoward@steptoe.com.

Patrick Linehan, Michael Gruden and Emma Howard

Steptoe