Self-assessment scores and False Claims Act exposure

A score is a statement

The number your company enters in the Supplier Performance Risk System looks like an administrative detail. It is a statement to the United States about the security of the systems holding its information, made by a company that wants to be paid under a contract. The False Claims Act exists for statements like that, and the Justice Department has been using it for this purpose for five years.

None of this means an imperfect score is a fraud problem. A low number reported truthfully is a legitimate position to be in, and the program has rules for improving it. The exposure comes from a number that is higher than the facts support, or that stays in the system after someone at the company learns it is wrong.

How the False Claims Act reaches a cybersecurity score

The Act, at 31 U.S.C. 3729, makes a person liable for knowingly presenting a false claim for payment, or knowingly making or using a false record or statement material to a false claim. Two features matter most to a small contractor.

First, "knowingly" is broader than the word sounds. It covers actual knowledge, deliberate ignorance of the truth, and reckless disregard of the truth, and the statute says it requires "no proof of specific intent to defraud." Second, the statement does not have to be in the invoice. A score or affirmation that helped win or keep the contract can be the false statement a later invoice rests on.

CMMC adds a second statement to the first. Under 32 CFR 170.22, a named official attests each year that the company has implemented and will maintain every applicable requirement. Each annual affirmation is a fresh representation with a fresh date, so a stale number does not grow harmless with age. It gets restated.

What it costs

Liability under the Act is three times the government's damages, plus a civil penalty for each violation. For penalties assessed after July 3, 2025 on violations occurring after November 2, 2015, 28 CFR 85.5 sets that penalty at a minimum of $14,308 and a maximum of $28,619 per violation. On a contract with many invoices, the per-violation count can grow quickly and independently of the dollar value of the work.

The settlements in the table below run from $421,234 to $13 million. Each one also arrives with legal fees, a government investigation running through your staff and your customers, and a public press release carrying your company's name.

The whistleblower route

The False Claims Act lets a private person sue on the government's behalf. These are called qui tam suits, and the person bringing one is called a relator. The complaint is filed under seal for at least 60 days while the government investigates, so a company may not know a case exists until well after it was filed.

If the government takes over the case, the relator receives at least 15 percent and no more than 25 percent of the proceeds. If the government declines and the relator wins alone, the range is 25 to 30 percent. The Act also protects employees from retaliation. In the public record, relators in these cases include a former quality-control manager at a machining company and members of a university's own cybersecurity team. The person most likely to know your score is wrong already works for you.

The person most likely to know your score is wrong already works for you.

What DOJ has announced

The Justice Department launched its Civil Cyber-Fraud Initiative on October 6, 2021, specifically to use the False Claims Act against contractors that knowingly provide deficient cybersecurity products or services, knowingly misrepresent their cybersecurity practices, or knowingly violate obligations to monitor and report incidents. These public resolutions show the pattern. Each press release states that the claims are allegations only and that there has been no determination of liability.

Company	Announced	Paid	What the government alleged
MORSECORP Inc.	March 26, 2025	$4.6 million	Reported a score of 104 in January 2021; an outside consultant later found the score was actually -142; no consolidated written plan for its covered systems for a period
Georgia Tech Research Corp.	September 30, 2025	$875,000	Submitted a summary score of 98 presented as campus-wide, when there was no campus-wide system; a lab lacked anti-virus tools and, for a period, a system security plan
Swiss Automation Inc.	December 5, 2025	$421,234	A precision machining supplier allegedly failed to provide adequate cybersecurity for certain part drawings, including NIST SP 800-171 controls
LOGZONE Inc.	June 18, 2026	$507,144	A government assessment produced a score of -170, near the bottom of the possible range
Honeywell Aerospace	September 1, 2026	$2,042,518	A business unit allegedly failed to meet NIST SP 800-171 on one network
ILC Dover and ILC Astrospace	November 3, 2026	$13 million	Controls not fully implemented; current assessments not submitted; system security plans not developed and updated

Three of those six releases cite a missing or incomplete system security plan, the document that should be the easiest to produce. The Swiss Automation matter also deserves a machine shop owner's attention. The company supplied parts to DoD prime contractors, and the government alleged it knew the requirement reached subcontractors and suppliers as well. Small size and a place low in the supply chain did not keep it out of a press release.

The MORSECORP case also shows why a correction has a clock. According to the release, a consultant told the company in July 2022 that its score was actually -142. The company did not correct its DoD score until June 2023, three months after receiving a government subpoena.

The same scale, read honestly

The DoD scoring range runs from -203 to 110. A score is calculated by starting at 110 and subtracting points for requirements not met: 5 for those that could lead to significant exploitation of the network or exfiltration of CUI, 3 for a specific and confined effect, and 1 for a limited or indirect effect. Two requirements adjust. Multifactor authentication costs 3 points if it covers only remote and privileged users and 5 if no users have it, and encryption costs 3 points if it is employed but not FIPS-validated and 5 if it is absent. Here is how the public numbers look on that scale.

How scores get inflated

An inflated score does not need an invented number. It can be the sum of small, comfortable assumptions made by someone in a hurry.

• Counting a plan as a control. Under 32 CFR 170.24, a requirement not implemented is scored not met, whether or not it appears in a plan of action
• Partial credit that does not exist. The method credits partial implementation only in limited cases, such as multifactor authentication and encryption
• Scoring the requirement but not its objectives. Requirements are assessed by objective, and one unmet objective makes the requirement not met
• Scoring an environment that is not the real one. A number that applies to a system nobody actually uses for CUI answers the wrong question
• A score nobody revisits. The network changes, the staff changes, and the entry in SPRS stays where it was
• No system security plan. Without a current plan, the rule says an assessment could not be completed at all

The suspension is a weak shelter

Latham & Watkins has noted that the Phase 2 suspension may give contractors a materiality argument, that the government no longer regards CMMC compliance as material. An argument available in litigation is a poor thing to plan a compliance program around. The firm also says plainly that a false affirmation or overstatement may expose contractors to significant liability, and the duties in DFARS 252.204-7012 have run for years independent of CMMC.

What a defensible score looks like

A defensible score is one a stranger can rebuild from your file. Every number should lead back to an objective, and every objective to a piece of final evidence.

• Score against NIST SP 800-171A objectives, requirement by requirement, and record the result for each objective
• Tie each met objective to named evidence: the screenshot, configuration export, log or signed policy, with a date
• Use evidence in final form, since the rule excludes working papers, drafts and unofficial policies
• Have someone other than the system's operator test a sample, and keep the results
• Record who scored it, when and against which scope, and keep prior versions
• Enter the honest number in SPRS, including every requirement you scored not met

When you find the score is wrong

Treat a discovered error as urgent. Stop relying on the old number in new proposals and affirmations, document what was found and when, and correct the entry in SPRS as soon as you know the right score. If the error may have affected a contract, bring in government contracts counsel promptly to decide what to disclose to the contracting officer, because that decision carries consequences of its own. Time passing after you learn the facts is the part of these stories that reads worst.

Treat employees who raise a concern as an early-warning system. The Act protects them from retaliation, and an internal concern handled well is far cheaper than the same concern filed under seal.

Frequently asked questions