Why a security attestation to government now carries fraud risk

The week

On October 6, 2021, Deputy Attorney General Lisa Monaco announced the Justice Department’s Civil Cyber-Fraud Initiative. The department said it would use the False Claims Act against federal contractors and grant recipients that put government information or systems at risk. Its targets were knowingly deficient cybersecurity products or services, knowing misrepresentation of security practices, and knowing violations of duties to monitor and report incidents. The False Claims Act allows the government to recover treble damages plus per-claim penalties. It also lets private whistleblowers, known as relators, file cases on the government’s behalf and share in any recovery. The announcement drew little notice at the time. The same week, a global outage at a major social network dominated technology news.

Before October 2021, a security requirement in a federal contract was enforced the way most contract terms are: audits, corrective action plans and, at worst, a lost award. The Civil Cyber-Fraud Initiative attached a fraud statute to the distance between a supplier’s security statements and its practice. For agencies, public universities, health systems and companies that take federal money, that turned a compliance question into a pricing and procurement one. We look at three parts: the liability mechanism, the statements it exposed, and the economics it changed on both sides of the table.

The liability mechanism

The False Claims Act does not punish weak security. It punishes knowingly presenting false claims for payment, or making false statements material to those claims. The department’s theory was direct. If a contractor certifies compliance with a cybersecurity clause and the certification is knowingly false, invoices submitted under that contract may be false claims. “Knowingly” includes deliberate ignorance and reckless disregard. An organization cannot protect itself by declining to look.

Two features set this apart from ordinary contract enforcement. The first is the size of exposure: treble damages plus a penalty for each claim, which can exceed the value of the contract itself. The second is the relator. An employee who sees a gap between an attestation and reality can file under seal, and the organization may not learn of the case until the government decides whether to intervene. Every security engineer, internal auditor and compliance analyst who knows where the gaps are is a potential relator. That gives the organization a strong reason to make internal escalation work, because a relator who was ignored internally has every incentive to go outside.

The knowledge standard also changes how a security program should handle its own findings. Most programs keep a list of known gaps, such as a plan of action and milestones for unmet controls. That list is healthy. It becomes dangerous when a certification of full compliance is signed while the list is open. The defensible pattern is to disclose the gap where the contract allows it, attach a dated remediation plan, and make sure the person signing has read the list. A self-assessment score that rises with no matching change in controls is the kind of fact a relator’s lawyer looks for.

The statements it exposed

The practical exercise was to list every statement that could be read as a representation of security practice. The list was longer than most organizations expected. It included certifications of compliance with contract clauses, such as the defense clauses requiring protection of controlled unclassified information. It included system security plans and self-assessment scores posted to the Defense Department’s Supplier Performance Risk System. It included answers to security questionnaires during source selection, and security sections of technical proposals. It also included incident reporting duties, where silence or a late report could itself be the violation.

Grant recipients were named explicitly. That reached state and local agencies, public universities, research hospitals and nonprofits whose awards carry security conditions. Those conditions had often been treated as boilerplate signed by a grants office that never consulted the CISO. After October 2021, each one was a commitment someone might be asked to prove.

The organizational fix was to treat attestations like financial certifications. That means a register of every security statement made to a government customer or grantor, with the person who signed it, the evidence behind it and the date it was last checked. It also means a rule that proposal and grants teams cannot describe a control the security function has not confirmed. Many organizations found that their sales and grants language ran well ahead of their control evidence.

The economics on both sides

For suppliers, the expected cost of an inaccurate attestation rose sharply. That made it rational to spend more on verifying controls before signing, and to say less, more precisely, in proposals. Marketing language about “military-grade” or “fully compliant” security became a liability rather than a selling point. Some smaller firms concluded that certain contracts were not worth the compliance overhead, which narrowed the field in niche markets. Buyers should expect that effect to show up as fewer bidders and higher prices for work with heavy security terms.

For government buyers, the effect was subtler. Agencies gained an enforcement backstop, but the deterrent only works against clear requirements. A vague clause is hard to certify against and hard to prove false. Agencies that wanted the initiative to bite had to specify the standard, the evidence expected and the reporting window. That pushed procurement offices toward named frameworks, such as NIST SP 800-171 for controlled unclassified information, and away from bespoke security language written contract by contract.

State agencies sit in the middle. A state that certifies a federal grant condition relies on the vendors that run the funded program, such as a benefits system integrator or a hosted case management platform. If the vendor’s controls fall short, the state signed the certification. Flow-down clauses therefore need evidence rights, not just obligations: the right to see assessment results, to receive incident reports within a set window, and to require remediation plans. The cost of collecting that evidence belongs in the program budget from the start, not as an unfunded audit task later. Organizations should check with counsel on which certifications they make, because obligations differ by contract and award.

With hindsight

The initiative produced cases. In 2022, Aerojet Rocketdyne agreed to pay $9 million to settle a whistleblower suit alleging it misrepresented its compliance with federal cybersecurity requirements. In 2024, Pennsylvania State University settled allegations about controls on defense research contracts, and the department intervened in a whistleblower case against the Georgia Institute of Technology. The pattern was consistent: a known gap, a certification that ignored it, and an insider who raised it. Meanwhile, the Defense Department’s Cybersecurity Maturity Model Certification program became binding, with its program rule finalized in late 2024 and contract clauses phasing in from November 2025, adding third-party assessment for many contracts. By this point in 2026, security attestations in federal procurement are drafted, evidenced and signed with the care once reserved for financial certifications.