Listen to this post

While traditional government enforcement areas, such as healthcare, dominate headlines, one emerging enforcement priority continues to grow, albeit with less fanfare: compliance with cybersecurity requirements in government contracts. The government announced its most recent settlement last month, signaling that these enforcement actions continue to proliferate. 

Why It Matters

Cybersecurity enforcement is here to stay.  In 2025, the Department of Justice (DOJ) recovered more than $50 million through cybersecurity enforcement actions. With its most recent settlement announcement last month, the government is sending a clear signal that this remains a priority. 

Contractors should be even more concerned because the government is now treating cybersecurity requirements as part of its broader enforcement agenda, tying them to the administration’s newly created Fraud Division and Task Force to Eliminate Fraud. The government is also discussing these cases in more consequential terms than traditional False Claims Act (FCA) matters.  Alongside familiar priorities, such as protecting the public fisc, DOJ now describes cybersecurity enforcement as “critical to national security[.]” Fitting squarely within the administration’s broader agenda and backed by the resources of a new task force and DOJ division, cybersecurity enforcement actions have become prime government targets. 

The Recent Settlement

On June 18, 2026, DOJ announced that a contractor agreed to pay $507,144 to resolve allegations that it failed to implement certain cybersecurity protocols during its contracts with the Navy. According to the settlement agreement, the contractor was required to implement, but did not fully implement, security protocols set forth in the National Institute of Standards and Technology’s (NIST) Special Publication (SP) 800-171. 

The contractor also reported perfect compliance on its self-assessment. Defense Federal Acquisition Regulation Supplement (DFARS) clauses 252.204-7019 and 252.204-7020 require the contractor to report self-assessment scores measuring  compliance with these security requirements. Self-assessment scores range from  -203 to  110.  Although the contractor reported a perfect self-assessment score of 110, the government assigned it a score of -170 after conducting its own assessment.

Notably, this enforcement action appears to have been driven entirely by the government rather than the an internal whistleblower. The government is demonstrating its willingness to proactively identify noncompliance and pursue these emerging cybersecurity FCA cases, consistent with the administration’s enforcement priorities.

One issue to watch is how courts will interpret these contract provisions under the FCA’s demanding materiality standard. Mere noncompliance with a certification is not enough to establish FCA liability. To satisfy the FCA’s materiality requirement, noncompliance with a contractual term must be “so central to” the purpose of the government contract that the government “would not have paid the [] claims had it known of the [] violations” (Universal Health Servs., Inc. v. United States, ex rel. Escobar, 579 U.S. 176, 196 (2016)).

Although the administration has clearly made cybersecurity a priority, it remains less clear whether failure to comply with cybersecurity certifications is “central” to a government contract to satisfy the FCA’s materiality standard. That analysis will largely depend on the specific services the government is procuring under the contract and the nature of the data at issue. 

Government contractors should therefore exercise care in maintaining cybersecurity protocols and proactively addressing potential vulnerabilities amid increasing government scrutiny.