Why a security attestation to government now carries fraud risk

The week

On October 6, 2021, Deputy Attorney General Lisa Monaco announced the Justice Department’s Civil Cyber-Fraud Initiative. The department said it would use the False Claims Act against federal contractors and grant recipients that put government information or systems at risk. The initiative was to be led by the Civil Division’s Commercial Litigation Branch, Fraud Section, the unit that already brought most of the government’s civil fraud cases.

Speeches by senior Justice Department officials about contract enforcement rarely reach a hospital boardroom or a university president’s office; this one deserved to. The False Claims Act is an old and powerful law aimed at people who cheat the government. It dates from the Civil War and was originally written to stop suppliers billing for goods they never delivered. Applying it to cybersecurity meant that a misleading promise about protecting data could be treated, legally, like a misleading invoice.

The department named three targets. The first was knowingly deficient cybersecurity products or services: selling the government something you know does not meet the security standard it requires. The second was knowing misrepresentation of security practices: saying you do things, such as encrypting data or reviewing access, that you do not do. The third was knowing violations of duties to monitor and report incidents: failing to watch for breaches, or saying nothing when one happens, when the contract says you must speak up.

The department framed the initiative in terms of outcomes as well as penalties. It said the effort would hold contractors and grantees to their commitments, encourage better security practice across the supplier base, and help agencies learn of breaches promptly. It also aimed to recover taxpayer money when security promises were broken. The emphasis on timely reporting mattered, because it treated silence after an incident as part of the problem.

The stakes come from how the law works. The False Claims Act allows the government to recover treble damages, meaning three times the losses, plus a civil penalty for each individual claim, adjusted for inflation every year. Because each invoice can count as a claim, the total can add up quickly. The law also lets private whistleblowers, known as relators, file cases on the government’s behalf and share in any recovery. A relator is often an insider: an engineer, auditor or compliance analyst who knows where the gaps are.

The announcement had a clear lineage. In May 2021, after the Colonial Pipeline ransomware attack, Monaco had ordered a comprehensive review of how the department handled cyber threats. The same month, Executive Order 14028 directed changes to federal procurement rules on incident reporting and secure software. The Cyber-Fraud Initiative was one product of the review. On the same day, she also announced a National Cryptocurrency Enforcement Team, aimed at crimes such as ransomware payments and illicit exchanges.

The legal theory was not entirely new either. In 2019, Cisco had paid $8.6 million to settle a False Claims Act case over a video surveillance product sold to federal agencies with known vulnerabilities. That was widely described as the first such cybersecurity settlement. The same year, a federal court allowed a whistleblower suit against Aerojet Rocketdyne, alleging misrepresented compliance with defense cybersecurity rules, to proceed. What changed in October 2021 was intent: the department said it would look for these cases deliberately rather than wait for them.

The defense rules themselves had just tightened. An interim rule that took effect on November 30, 2020 required many defense contractors to self-assess against NIST SP 800-171, a federal catalog of security requirements. They then had to post a numeric score to the Defense Department’s Supplier Performance Risk System. The department was also reworking its Cybersecurity Maturity Model Certification program, known as CMMC. It announced a streamlined version a month later, on November 4, 2021. Self-reported scores and signed certifications were therefore multiplying just as the fraud theory arrived.

The announcement drew little notice at the time. Two days earlier, a global outage at Facebook and its sister services had dominated technology news. But it mattered to any organization that takes federal money, from defense suppliers to research universities to state agencies running federally funded programs. It changed who carries the risk when a security statement turns out to be untrue.

Before October 2021, a security requirement in a federal contract was enforced the way most contract terms are: audits, corrective action plans and, at worst, a lost award. Uncomfortable, but manageable, and mostly a matter for the security and contracts teams. The Civil Cyber-Fraud Initiative changed that by attaching a fraud statute to the distance between a supplier’s security statements and its practice.

For agencies, public universities, health systems and companies that take federal money, that turned a compliance question into a pricing and procurement one. It also moved the question up the organization, to whoever signs. The analysis below takes six steps in order: what is being promised, how liability attaches, which statements were exposed, the economics on both sides, how an attestation travels through an organization, and the habits of the organizations that coped.

First, what is being promised

The risk starts with the security attestation: a formal statement, usually signed, that something is true. In federal contracting, organizations attest that they follow particular security practices, called controls. A control is a specific safeguard. Examples include requiring a second login step before staff can reach sensitive systems, encrypting data so it is unreadable if stolen, keeping logs of who accessed what, and patching software within a set time.

The frameworks behind the promises

The government publishes lists of these controls in frameworks. The one that comes up most for contractors is NIST SP 800-171, a catalog of requirements for protecting controlled unclassified information. In the revision then in force, it set out 110 requirements grouped into 14 families, from access control to incident response. Controlled unclassified information sounds obscure but covers a great deal. It includes technical drawings for defense work, certain research data and personal information held for a federal program.

Defense contracts carry a clause, DFARS 252.204-7012, that requires contractors to protect such information using NIST SP 800-171. It also requires them to report cyber incidents to the Defense Department within 72 hours of discovery. Since late 2020, related clauses have required a self-assessment against the framework, with the score posted to the Supplier Performance Risk System. The scoring starts at 110 and subtracts weighted points for each requirement not met. A perfect score means every requirement is in place.

Other sectors face other frameworks. State agencies that handle federal tax information follow IRS Publication 1075. Agencies and contractors with access to criminal justice information follow the FBI’s CJIS Security Policy. Federal grant recipients are bound by the Uniform Guidance, which requires reasonable cybersecurity measures to protect personal information, along with any security terms in a specific award. Each produces its own form of promise.

Self-assessment, plans and questionnaires

Organizations often measure themselves against these frameworks with a self-assessment, essentially grading their own homework. They also write a system security plan, a document describing how their systems are protected. Gaps go on a plan of action and milestones, a dated list of what remains to be fixed. And they answer security questionnaires when bidding for work. Each of these is a statement of fact. Before 2021, an inaccurate one was mainly a compliance problem. After 2021, a knowingly inaccurate one could be fraud.

Promises that drift

Many security statements are true when signed and become untrue later. A control can lapse when a system is migrated, a policy exception becomes permanent, or the engineer who ran a monthly review leaves. Annual certifications capture a moment, while contract obligations usually run continuously.

That drift is where well-meaning organizations get into trouble. Nobody lied on the day of signing, but nobody checked again either, and invoices kept going out. Once someone inside knows a control has lapsed, continuing to bill without correction starts to look like knowledge. The practical answer is to tie statements to the change process. Any change that touches a certified control should prompt a check of the related statement.

Why self-attestation invited trouble

Self-attestation was a practical choice. The defense supplier base runs to many thousands of companies, and the government could not inspect them all. A small assessment center within the Defense Contract Management Agency checked a sample of contractors in depth. Everyone else was trusted to report honestly.

That design creates obvious incentives. A score posted to a government system is visible to contracting officers and to prime contractors choosing subcontractors. A low score can cost business. Meanwhile, the chance of any one score being checked was small. The gap between reported and actual security therefore tended to grow wherever nobody inside the company insisted on accuracy. A fraud statute with insider whistleblowers is one way to close that gap without inspecting everyone.

A restaurant posts a health inspection certificate in the window. If the kitchen slips between inspections, that is a problem for the inspector. If the owner forges the certificate, or keeps displaying it after being told the fridge is broken, that is a different and much more serious matter. The initiative put security attestations in the second category when the organization knew, or chose not to know, that they were false.

The liability mechanism

The False Claims Act does not punish weak security. It punishes knowingly presenting false claims for payment, or making false statements material to those claims. The department’s theory was direct. If a contractor certifies compliance with a cybersecurity clause and the certification is knowingly false, invoices submitted under that contract may be false claims.

Three routes from a statement to a claim

Case law gives the government several routes. Under express false certification, the contractor signed a statement of compliance that was untrue. Under implied false certification, the contractor submitted a claim for payment while staying silent about a violation of a requirement material to payment. The Supreme Court endorsed that theory, with limits, in its 2016 decision in Universal Health Services v. United States ex rel. Escobar. Under fraudulent inducement, false statements made to win a contract can taint the claims that follow, even if each later invoice says nothing about security.

Escobar also set a demanding materiality standard. The violation must be the kind of thing that would affect the government’s decision to pay. Minor or insubstantial breaches do not qualify. That gives defendants a real argument when the government kept paying after learning of a problem. It also explains why the initiative pushed agencies toward explicit, specific security terms. Requirements written as conditions of payment, with a clear standard, are much easier to show were material.

What “knowingly” means

“Knowingly” includes actual knowledge, deliberate ignorance and reckless disregard. An organization cannot protect itself by declining to look. A chief executive who signs a certification without asking whether it is true, or a grants office that never checks with the security team, is not shielded by not knowing. Honest mistakes and good-faith disagreements about what a requirement means are a different matter. The statute is aimed at the gap between what an organization knew and what it said.

Exposure and the relator

Two features set this apart from ordinary contract enforcement. The first is the size of exposure: treble damages plus a penalty for each claim, which can exceed the value of the contract itself. A modest contract with many monthly invoices can produce a liability far larger than the revenue it earned.

The second is the relator. An employee who sees a gap between an attestation and reality can file under seal, meaning confidentially. The organization may not learn of the case until the government decides whether to intervene, a process that often takes well over a year. If the government intervenes, the relator usually receives between 15 and 25 percent of the recovery. If it declines, the relator can pursue the case alone for a larger share. The statute also protects employees against retaliation for such efforts.

Every security engineer, internal auditor and compliance analyst who knows where the gaps are is therefore a potential relator. That gives the organization a strong reason to make internal escalation work. A relator who was ignored internally has every incentive to go outside.

The gap list problem

The knowledge standard also changes how a security program should handle its own findings. Most programs keep a list of known gaps. That list is healthy; it shows the organization is honest with itself. It becomes dangerous when a certification of full compliance is signed while the list is open.

The defensible pattern is to disclose the gap where the contract allows it, attach a dated remediation plan, and make sure the person signing has read the list. A self-assessment score that rises with no matching change in controls is the kind of fact a relator’s lawyer looks for.

Suppose a mid-sized engineering firm wins a defense subcontract. Its security manager keeps a spreadsheet showing that a second login step is not yet in place for remote staff, with a target date six months away. Meanwhile, the contracts team signs an annual certification of full compliance, copying last year’s form. Two years later, the security manager leaves after a dispute and files a whistleblower complaint. The firm’s own spreadsheet is now the central exhibit. Nothing about the firm’s technology changed; what changed was that a known gap and a signed promise sat side by side.

How a case unfolds

A typical matter begins out of the organization’s sight. A relator files under seal, or an agency refers a concern. The department may then issue a civil investigative demand, a compulsory request for documents, answers and testimony. The organization learns it is under scrutiny, but often not who complained or exactly what they alleged.

What follows is mostly document work. Investigators compare certifications, system security plans and posted scores against internal records: gap lists, assessment reports, emails and tickets. They interview staff. The organization’s own security documentation becomes the evidence, which is why honest records with dated plans matter so much.

Damages are often contested. The government may argue it paid for secure services it did not receive. A defendant may argue the services were delivered and the government lost nothing. Courts and settlements have handled this in different ways, and the uncertainty itself pushes both sides toward settlement. Organizations should take counsel’s advice early rather than after a demand arrives.

Cooperation and self-disclosure

The department also offered a route out. Its False Claims Act guidance, issued in 2019, gives credit to organizations that disclose problems voluntarily, cooperate with investigations and fix the underlying issues. Department officials later pointed to that framework when discussing cyber cases. An organization that finds a false statement in its own records therefore faces a real choice. Disclosing early costs money and reputation, but it typically reduces the multiplier and avoids the relator problem entirely. Counsel should guide that decision.

The statements it exposed

The practical exercise was to list every statement that could be read as a representation of security practice. The list was longer than most organizations expected.

• Certifications of compliance with contract clauses, such as the defense clauses requiring protection of controlled unclassified information.
• System security plans and the self-assessment scores posted to the Supplier Performance Risk System.
• Answers to security questionnaires during source selection, the stage where the government chooses between bidders, and security sections of technical proposals.
• Representations in product documentation and marketing that a product meets a named government standard.
• Incident reporting duties, where silence or a late report could itself be the violation.

Grant recipients and the public sector

Grant recipients were named explicitly. That reached state and local agencies, public universities, research hospitals and nonprofits whose awards carry security conditions. Those conditions had often been treated as boilerplate signed by a grants office that never consulted the CISO, the chief information security officer. After October 2021, each one was a commitment someone might be asked to prove.

The exposure differs by type of organization. A defense prime contractor already has contract compliance staff and a culture of certifications; its risk is mainly in its supply chain. A small manufacturing subcontractor may have no security staff at all and a score posted by an outside consultant. A research university faces a split world. Much of its work is fundamental research, which is generally outside controlled unclassified information rules. A few labs on defense contracts may still carry the full clause, and those labs often run their own computing outside central IT.

A health system meets the issue through several doors. It may hold federal research grants, provide services under contracts with the Department of Veterans Affairs or the Defense Health Agency, or run federally funded programs. Each carries its own terms. A state agency typically has the most varied mix: federal tax information rules, criminal justice information rules, program-specific security terms from federal partners, and grant conditions. Each produces separate statements that different offices sign.

Building the register

The register is easier to build than most teams expect, because the statements already exist in identifiable places. Contract management systems hold the clauses and signed representations. Grants systems hold award terms and certifications. Proposal libraries hold the questionnaire answers and security narratives that teams reuse. The Supplier Performance Risk System holds posted scores. The public website and product documentation hold marketing claims.

Each entry needs a small set of fields. Record the statement, the contract or award, the signer, the date, the evidence relied on and the control owner. Add the date of the last check and any related open gap. A first pass usually finds duplicates and stale language, and it often finds statements nobody in security has seen. Those are the entries to review first.

The register should be refreshed on a schedule and on events. Natural triggers include a new award, a renewal, an assessment, a significant incident and a material change to the environment, such as a cloud migration.

Treating attestations like financial certifications

The organizational fix was to treat attestations like financial certifications. Most executives already understand that signing financial statements carries personal responsibility and requires evidence. The same discipline applies here. That means a register of every security statement made to a government customer or grantor, with the person who signed it, the evidence behind it and the date it was last checked.

It also means a rule that proposal and grants teams cannot describe a control the security function has not confirmed. Many organizations found that their sales and grants language ran well ahead of their control evidence.

The economics on both sides

For suppliers, the expected cost of an inaccurate attestation rose sharply. That made it rational to spend more on verifying controls before signing, and to say less, more precisely, in proposals. Marketing language about “military-grade” or “fully compliant” security became a liability rather than a selling point.

Suppliers: verification costs and narrower fields

Verification is not free. An honest self-assessment against 110 requirements, with evidence for each, takes weeks of staff time for a small firm. Closing the gaps it finds can take much longer, especially for requirements such as multifactor authentication everywhere or encryption validated to federal standards. Some smaller firms concluded that certain contracts were not worth the compliance overhead, which narrowed the field in niche markets. Buyers should expect that effect to appear as fewer bidders and higher prices for work with heavy security terms.

Insurance is a further question. Cyber insurance policies are written for breaches and their costs, and many policies exclude fines, penalties or fraud. Directors and officers coverage may respond differently. Organizations should ask their brokers and counsel what, if anything, would respond to a False Claims Act matter, rather than assume.

Government buyers: the clarity requirement

For government buyers, the effect was subtler. Agencies gained an enforcement backstop, but the deterrent only works against clear requirements. A vague clause is hard to certify against and hard to prove false. If a contract says only “the vendor shall maintain appropriate security,” almost any practice can be called appropriate.

Agencies that wanted the initiative to bite had to specify the standard, the evidence expected and the reporting window. That pushed procurement offices toward named frameworks, such as NIST SP 800-171 for controlled unclassified information, and away from bespoke security language written contract by contract.

Prime contractors and their suppliers

The economics also run down the supply chain. Prime contractors must flow security clauses to subcontractors that handle controlled information, and many ask suppliers for their scores before awarding work. A false statement made to a prime contractor can still reach the False Claims Act. The statute covers requests for payment made to contractors and grantees when the money comes from federal funds.

This shifts work onto primes. A prime that accepts a supplier’s score without checking may find its own certifications undermined. Larger primes responded by asking for evidence, running their own supplier assessments, and limiting which suppliers receive controlled information at all. Each of those choices adds cost and friction for small suppliers.

States and counties in the middle

State agencies are caught in between. A state that certifies a federal grant condition relies on the vendors that run the funded program, such as a benefits system integrator or a hosted case management platform. If the vendor’s controls fall short, the state signed the certification.

Flow-down clauses, the terms that pass obligations from the prime agreement down to subcontractors, therefore need evidence rights as well as obligations. They should include the right to see assessment results, to receive incident reports within a set window, and to require remediation plans. The cost of collecting that evidence belongs in the program budget from the start, not as an unfunded audit task later. Organizations should check with counsel on which certifications they make, because obligations differ by contract and award.

Take a hypothetical county that runs a federally funded rental assistance program on a vendor’s hosted platform. The county signs the grant’s security conditions. Its contract with the vendor says the vendor “will comply with all applicable security requirements” but gives the county no right to see any evidence. If the vendor’s practices fall short, the county has made a promise it had no way to check. Rewriting the contract costs money and negotiating time, which is why it belongs in the budget at the start.

The case against the initiative

The strongest criticism is that a fraud statute is a blunt tool for a technical field. Security requirements are complex, often ambiguous and constantly changing. Few organizations meet every control at every moment. Critics argued that the threat of treble damages would push organizations to say as little as possible, making the government’s picture of its suppliers less accurate rather than more. Others worried that relator bounties would reward going to court over fixing problems internally.

These are fair concerns, and they explain why the standard matters. The statute requires knowledge and materiality, and Escobar made materiality a real hurdle. Organizations that make honest, specific statements and disclose known gaps sit well outside the danger zone. The risk falls mainly on those who certify what they know to be untrue. A rule that makes that costly is hard to argue against, even if its edges need care.

How an attestation actually travels through an organization

Follow a single security statement from start to finish and the risk usually turns out to arise in the handoffs rather than in any one person’s bad intent.

From bid to signature

It often begins with a bid. A business development team is racing a deadline and needs to answer a questionnaire. Does the company encrypt data at rest, meaning while it is stored on disks rather than moving across a network? Does it require a second login step for remote access? The team pulls answers from a previous proposal, because that is faster than asking. The answers were roughly true two years ago.

The bid wins. A contracts office now receives a set of clauses, some of which require the company to protect controlled unclassified information to a named standard and to report incidents within a fixed window. The contracts office signs, because signing is its job, and files the clauses. The security team may not see them at all, or may see them weeks later as an attachment to an email.

From signature to invoice

Meanwhile, the security team runs its own program. It knows where the gaps are and has a plan to close them. But its plan is driven by budget and risk priorities, not by the specific promises made in this particular contract. Nobody has matched the two lists.

Months later, a finance team submits invoices. Under the department’s theory, each one can carry the weight of the earlier certification. If the certification was knowingly false, each invoice may be a false claim.

No single person in this story set out to deceive anyone. The business development team reused old text. The contracts office signed standard terms. The security team worked its plan. Finance billed. The exposure comes from the fact that nobody owned the whole chain. That is why the fixes are mostly about joining up existing teams rather than buying new technology.

Incident reporting clocks

The same pattern applies to incident reporting. The defense clause requires a report within 72 hours of discovering a cyber incident, along with preservation of images of affected systems. Other contracts and awards set their own windows. If the security team discovers an intrusion but does not know which contracts carry which reporting duties, the clock may run out before anyone with that knowledge is told.

Connecting the incident response plan to the register of contractual duties is a small piece of work with a large payoff. The plan should list, for each contract or award, the reporting window, the recipient and the person who files. An incident exercise should include at least one scenario that tests whether the right reports go out on time.

Cloud providers and mergers

Two other routes carry statements across organizational lines. The first is cloud services. The defense clause requires that cloud providers storing covered defense information meet security requirements equivalent to the FedRAMP Moderate baseline, and report incidents in turn. A contractor that certifies compliance while using a cloud service that does not meet that bar has made a statement that depends on someone else. The provider’s documentation therefore belongs in the register as evidence, with a date.

The second is acquisitions. A buyer that acquires a government contractor inherits its contracts, its certifications and any false statements already made. Due diligence should compare posted scores and signed certifications with the target’s actual controls and gap lists. Where they diverge, the buyer can negotiate a price adjustment, an indemnity or a disclosure plan before closing rather than discover the problem through a relator afterward.

Where the evidence lives

Every statement needs evidence that would satisfy someone skeptical. For a control such as multifactor authentication, that means configuration exports showing it is enforced, a list of exceptions with approvals, and logs showing it was in force over time. For a process control such as access reviews, it means dated records of each review and the changes it produced. Screenshots taken the week before an assessment are weak; continuous records are strong.

The evidence should be stored where the signer can see it and where it survives staff turnover. When a key engineer leaves, the organization must still be able to show what was true on the date of each certification.

Habits of the organizations that coped

Organizations that handled this well tended to share a few habits:

• One register of promises. Every security statement made to a government customer or grantor is logged, with the signer, the evidence and the last review date.
• Security signs off before sales does. Proposal and grants teams cannot describe a control in writing until the security function has confirmed it exists.
• Honest gap lists, honestly disclosed. Known gaps are recorded with dated plans, and certifications reflect them where the contract allows.
• Signers who read. The person who signs a certification has seen the evidence and the open gap list, and that review is recorded.
• An internal door that works. Staff concerns about inaccurate statements go to someone with authority to fix them, and the response is documented.
• Contracts with teeth for vendors. Flow-down clauses include evidence rights, incident reporting windows and remediation duties.

Roles and sequencing

The habits need owners. In a company, the general counsel or chief compliance officer typically owns the register and the signing rule. The CISO owns the evidence and the gap list. Contracts and grants offices route every security term through both before signature. Internal audit tests the chain once a year by picking certifications at random and tracing them to evidence.

The sequencing matters. Start with the register, because it shows the scale of the problem. Next, compare each entry with the current gap list and fix or disclose any conflicts. Then change the bid and signing process so new statements cannot bypass security review. Finally, set up the internal reporting route and train managers to treat concerns as compliance matters, not personnel disputes.

Training the people who write and sign

Most of the people who make security statements are not security staff. Proposal writers, grant administrators, contracts officers, sales engineers and executives all put words on paper that a government customer may rely on. Short, specific training for these groups pays off. It should explain which statements count as representations and why copying old answers is risky. It should also show how to route a question to security and how to describe a control that is only partly in place.

Signers need their own briefing. A senior official asked to sign an annual certification should know what the certification says, what evidence supports it, which gaps are open and what disclosure the contract allows. A one-page summary prepared by security and reviewed by counsel, kept with the signed form, is a simple record that the signer read before signing.

Measures a board can follow

A few measures show whether the habits are working. Track the number of security statements in the register and the share with current evidence. Count statements in conflict with an open gap, which should trend to zero. Measure the time from a contract award to security review of its clauses. Count staff concerns raised internally and the share answered within a set period. Together these give a board a view of accuracy as well as of controls.

The failures were the mirror image:

• Copying last year’s certification forward without checking whether anything changed.
• Letting a grants or contracts office sign security conditions without consulting security staff.
• Treating marketing claims about security as harmless because “everyone says that.”
• Raising a self-assessment score to win work without a matching change in controls.
• Dismissing an employee’s concern as a personality issue rather than recording and answering it.
• Assuming that a vendor’s promise transfers the risk, when the organization signed the certification.

What the signers should ask

A chief executive, general counsel or board audit committee can ask these without technical knowledge:

• Where do we make written statements about our security to a government customer or grantor, and is there one list of them?
• For each statement, who signed it, what evidence supports it, and when was it last checked?
• Do we have open security gaps that conflict with anything we have certified, and have we disclosed them where the contract allows?
• If an engineer believed one of our certifications was wrong, who would they tell, and what would happen next?
• For programs run by vendors on our behalf, what evidence of their controls do we actually receive, and how often?

An organization does not need to be perfect, only accurate. A clear list of what has been promised, matched against honest evidence of what is done, is both the best defense and the cheapest one.

With hindsight

The initiative did not stay theoretical; it produced cases. In March 2022, a medical services contractor to the State Department and the Air Force agreed to pay about $930,000. The allegations included storing patients’ medical records on an unsecured network drive. It was the first settlement announced under the initiative. In July 2022, Aerojet Rocketdyne agreed to pay $9 million to settle the whistleblower suit, brought by a former senior cybersecurity employee, that a court had allowed to proceed in 2019.

In 2023, Verizon Business agreed to pay about $4.1 million over a managed internet security service it provided to federal agencies through the General Services Administration. The company had disclosed the problem itself and received credit for cooperating. The case showed that the self-disclosure route was real. The same year, the Supreme Court’s decision in United States ex rel. Schutte v. SuperValu held that the act’s knowledge standard turns on what the defendant actually understood and believed. A company cannot escape liability by pointing to a reasonable reading of an ambiguous rule that it did not in fact hold.

In 2024, Pennsylvania State University settled allegations about controls on defense research contracts, agreeing to pay $1.25 million. The department also intervened in a whistleblower case against the Georgia Institute of Technology and its research corporation, filing its own complaint in August 2024. The government alleged that a lab doing sensitive defense research had gone without basic anti-malware protection, and that a campus-wide assessment score of 98 had been based on a fictitious environment. The research corporation resolved the case for $875,000 in September 2025, without an admission of liability. The two relators were former members of Georgia Tech’s own cybersecurity team.

The pattern across these cases was consistent: a known gap, a statement that ignored it, and often an insider who raised it. No exotic attack figured in most of them. The inclusion of two major research universities confirmed that the risk was never limited to traditional defense contractors. The Georgia Tech resolution, announced in September 2025, also showed that the enforcement theory outlasted the change of administration.

Meanwhile, the Defense Department’s CMMC program became binding. Its program rule was finalized in October 2024, and contract clauses began phasing in from November 2025. Many contracts now require third-party assessment, and every level requires a senior official to affirm compliance each year. That annual affirmation is exactly the kind of signed statement the initiative targeted. Independent assessment reduces some of the ambiguity of self-attestation, but the signer remains responsible for what is affirmed between assessments.

Attestation spread beyond defense. Under a 2022 policy from the Office of Management and Budget, software producers selling to federal agencies were asked, from 2024, to sign a standard form attesting to secure development practices. In January 2025, a proposed rule would have extended controlled unclassified information requirements across civilian contracts through the Federal Acquisition Regulation. Research institutions also met the theme from the funding side, as some federal data programs began requiring users to attest to NIST SP 800-171 controls.

What held up from 2021 is the core argument: exposure depends on whether statements about controls are true, checked and owned. What needs qualifying is the dek’s emphasis on the person who signs. The resolved cases named organizations, not individual signers, and the cost to individuals has mostly been professional rather than legal. By this point in 2026, the signature on a security attestation is treated in federal procurement with the care once reserved for financial certifications.