Penn State University Hit With False Claims Act Suit For Alleged Cyber Security Deficiencies

On September 1, 2023, the U.S. District Court for the Eastern District of Pennsylvania unsealed a qui tam False Claims Act ("FCA") lawsuit (originally filed on October 5, 2022) alleging Penn State University failed to provide "adequate security" for Covered Defense Information, as contractually required by Defense Federal Acquisition Regulation Supplement ("DFARS") 252.204-7012.

DFARS requires contractors to implement cybersecurity controls, such as encrypting sensitive data, restricting access to sensitive systems, and conducting risk assessments. At a minimum, adequate security requires the implementation of NIST 800-171. And as a condition of receiving a Department of Defense ("DoD") contract, all contractors must carry out a Basic Assessment of NIST 800-171 and submit their score to the DoD. There is no official audit procedure to determine compliance, but rather, contactors must conduct a self-assessment and make an attestation to its compliance.