The finalization of CMMC brings much needed accountability to the Defense Industrial Base (DIB) ensuring that contractors are able to effectively protect CUI. To prove this, contractors must now undergo a third-party audit by a certified organization to prove they have implemented all 110 controls outlined in NIST SP 800-171 or face significant consequences. It's important to note that these requirements are not going away, despite the length of time it has taken to implement them. Katie Arrington, chief information officer of the DoD, has made it clear: CMMC is here to stay. Speaking at the UiPath Public Sector Summit in Washington D.C., she stated "the business of defense is not something we should take lightly. If it's too hard, get out of the business". For contractors who seek to do work with the federal government, failure to comply with NIST 800-171 requirements will result in consequences. This blog will discuss how the DoD plans to utilize the False Claims Act to hold contractors accountable for their security.
The False Claims Act was enacted in 1863 during the civil war to combat government contractors who were defrauding the Union. Often called "Lincoln's Law", the FCA included a provision that allowed non-government individuals (known as relators) to report fraud and receive a percentage of recovered damages. The law also offers protection against retaliation for whistleblowers and legal compensation. Since then, the FCA has continued to be used to combat fraud in healthcare, defense contracting, and cybersecurity compliance.
The Civil Cyber-Fraud Initiative
In October of 2021, the Civil Cyber-Fraud Initiative was created by the Department of Justice (DOJ) to utilize the FCA against government contractors who had misrepresented their adherence to cybersecurity compliance requirements. Using the FCA, the DOJ can prosecute government contractors and reclaim any funding that had been granted to them during their contract period. This has resulted in hundreds of thousands of dollars recovered in the past several years from some of the largest government contractors.
CMMC was put in place because government contractors were not accurately reporting their adherence to NIST SP 800-171 security requirements. In the past, contractors were allowed to conduct a self-assessment and then report their score to the Supplier Performance Risk System (SPRS). However, many of these scores were misleading at best and falsified at worst. As Katie Arrington states, "if industry had complied with NIST 800-171, CMMC wouldn't be so hard". This is why the Civil Cyber-Fraud Initiative was created and why the FCA is applicable to any contractor with CMMC requirements. If your organization is found to have misrepresented its CMMC compliance posture, you could face significant fines and litigation. This risk increases as CMMC becomes mandatory for contract eligibility.
MORSECORP
On March 26, 2025, the DOJ announced that the defense contractor MORSECORP Inc. agreed to pay $4.6 million in damages to settle their cybersecurity fraud allegations. Allegations were made that MORSE had "submitted fraudulent claims for payment on contracts with the Departments of the Army and Air Force" despite knowing they were not compliant with cybersecurity regulations. It was discovered that between January 2018 and September 2022, MORSE hosted their emails using a third-party company that was not up to the standard of the Federal Risk and Authorization Management Program Moderate Baseline. It was also found that MORSE had not implemented all of the controls required by NIST 800-171, submitting a score of 104/110 when in reality their score was actually -142.
Failing the comply with CMMC requirements can be very dangerous for your organization. Compliance is complex, but that doesn't mean it isn't any less important. Your organization must put in the effort to achieve and maintain the required level of security to protect both your business and the nation's national security.
Georgia Tech Research Corporation
In July of 2022, two Georgia Tech cybersecurity team members filed a whistleblower lawsuit under the False Claims Act alleging that the Georgia Tech Research Corporation (GTRC) had made false compliance claims to the DoD. Whistleblowers claimed that the GTRC did not have a system security plan (SSP) until February of 2020, and when created, left out many covered systems (like laptops and desktops). They also claimed that the GTRC had submitted an inaccurate SPRS score, claiming 98/110. Additionally, the GTRC had created a culture where staff felt their warnings were being ignored and, in some cases, employees felt they were isolated from certain projects due to their concern about the organization's compliance posture.
In 2024, the DOJ intervened, marking its first major case through the Civil Cyber-Fraud Initiative. Organizations found to have misrepresented their compliance posture may receive hefty financial consequences. In this case, the DOJ is seeking damages for as much as $30 million based off two of their contracts.
Aero Turbine Inc
In July of 2025, defense contractor Aero Turbine, and private equity company Gallant Capital Partners, agreed to pay $1.75 million to resolve their liability under the FCA. Aero Turbine and Gallant had, allegedly, failed to comply with NIST 800-171 requirements and had knowingly misrepresented their compliance posture under a Department of the Air Force contract. During this two-year period (2018-2020), the companies had allegedly failed to control the flow of sensitive information by utilizing an unauthorized software based out of Egypt. While no determination of liability was made, the two companies decided to settle.
This case is unique in that both companies' voluntary disclosed their failure to adhere to cybersecurity guidelines. When submitting your SPRS score, it's important to get it right the first time as even self-reported issues can end with an FCA liability.
S.A.F.E Structure Designs & USA Manufacturing
In January of 2025, S.A.F.E. Structure Designs, U.S.A. Manufacturing, and their owner, Johnny Buscema Jr., agreed to pay $1 million to resolve allegations that they violated the False Claims Act by manipulating the competitive bidding process on Defense Logistics Agency (DLA) contracts used by the Department of Defense. The companies allegedly coordinated with a prime vendor and other vendors to submit more than 100 “courtesy bids” — bids submitted with no intention of winning — in order to make other bids appear legitimate and satisfy competitive bidding requirements. Buscema also allegedly paid other vendors to submit similar bids and submitted bids from both of his companies on the same solicitations. According to the government, this conduct undermined fair competition and resulted in the DoD overpaying for goods and services purchased under these contracts.
This case highlights that the FCA is utilized for more than compliance misrepresentation and applies to traditional fraud within the DoD supply chain as well.
Honeywell Aerospace Inc.
In September 2026, Honeywell Aerospace Inc. agreed to pay more than $2 million to resolve False Claims Act allegations involving cybersecurity requirements under a Department of Defense contract. According to the DOJ, from April 2020 through December 2023, a Honeywell business unit allegedly submitted false claims for payment while failing to comply with applicable NIST SP 800-171 cybersecurity requirements for one of its networks.
While no determination of liability was made, the settlement reinforces the importance of ensuring that an organization’s cybersecurity practices match its compliance representations. For defense contractors, NIST SP 800-171 compliance must be implemented, accurately documented, and maintained—not simply addressed when preparing for an assessment.
CorpInfoTech helps defense contractors achieve and maintain CMMC/NIST SP 800-171 compliance through integrated compliance, cybersecurity, and managed IT services. As a CMMC Level 2 certified MSP, we understand what it takes to implement the required security controls, protect CUI, and maintain a secure, compliant environment over time.
Through TAS for CMMC Compliance, CorpInfoTech provides a practical path to compliance that helps reduce complexity and compliance scope while supporting contractors through every stage of the journey from defining requirements and assessing gaps to implementing controls, validating readiness, and maintaining continuous compliance.
Make Sure Your Compliance Reflects Your Actual Environment
Talk with CorpInfoTech about building and maintaining a secure, compliant environment that supports your CMMC/NIST SP 800-171 requirements. Review Your Compliance Position
CorpInfoTech, a Managed Service Provider (MSP) with over 25 years in the SMB space, is a trusted partner for business pursuing compliance and cybersecurity. We are a CMMC Level 2 (C3PAO) certified MSP and a Cyber AB Registered Provider Organization (RPO). Also, as the first CIS accredited organization, we help organizations implement the CIS controls as it pertains to CMMC and your overall cybersecurity posture. CorpInfoTech is your trusted partner for secure, compliant growth in every changing digital landscape.