Fraud Liability For Government Contractors With Lax Cybersecurity

The Department of Justice announced on October 6, 2021 the creation of a new Civil Cyber-Fraud Initiative to pursue penalties against government contractors who do not properly comply with the cybersecurity standards required by their contracts. This new risk, under the False Claims Act (FCA), means that CISOs should consult with their lawyers before starting cybersecurity compliance audits.    

The National Institute of Standards and Technology's (NIST) Special Publication (SP) 800-171 Rev. 2 outlines the information security framework federal contractors must adopt to protect networks when working on government contracts. To show compliance with the NIST framework, a contractor need only document an internal review of its cybersecurity policies and procedures and find them compliant. However, under the newly promulgated Cybersecurity Maturity Model, federal contractors will be required to have an independent third-party certify their compliance with the necessary