New Cybersecurity Rules And FCA Enforcement Actions Impacting Government Contractors

Two years after the Department of Justice (DOJ) established its Civil-Cyber Fraud Initiative, there has been a recent uptick in enforcement and regulatory activity related to cybersecurity. September opened with the unsealing of a qui tam action under the False Claims Act (FCA) against Penn State University, alleging the school failed to comply with the Department of Defense's (DoD) cybersecurity requirements. Only a few days later, the DOJ announced a $4 million settlement with Verizon Business Network Services LLC (Verizon) to resolve claims that the telecom giant failed to meet cybersecurity requirements in its provision of secure public internet connections to federal agencies. And in early October, the Federal Acquisition Regulatory Council published two proposed rules increasing cybersecurity requirements for government contractors, which may open many companies up to new or increased FCA liability.