Editor's note: CMMC has been updated several times since this post was first published, most recently when the Department of War suspended Phase 2 in July 2026. We have also rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 to reflect the current state of the program. For the latest information, see our CMMC Overview and our CMMC Calendar.
Last updated: October 2026
The False Claims Act is how the federal government enforces cybersecurity promises in defense contracts. If a contractor represents that it meets DFARS 252.204-7012 and NIST SP 800-171, posts an SPRS score it cannot support, or affirms a CMMC status that is not accurate, and does so knowingly or with reckless disregard, it can face treble damages and per-claim penalties. For contractors posting SPRS scores in Hawaii, the CMMC pause changed none of this. The Department of Justice has settled at least seven cyber-fraud cases since 2022. This post covers how the law works, the cases so far, and how to reduce your risk.
What Is the False Claims Act?
The False Claims Act (FCA) is a federal law that makes it illegal to knowingly submit a false claim for payment to the government, or to make a false record or statement material to one. It dates to 1863, when it was passed to stop fraud by Civil War suppliers, which is why it is still called the "Lincoln Law." Amendments in 1986 strengthened the whistleblower provisions and turned it into the government's primary anti-fraud tool.
Three parts of the law matter most for contractors:
- "Knowingly" is broad. It covers actual knowledge, deliberate ignorance, and reckless disregard of the truth. The government does not need to prove intent to defraud.
- Damages are steep. Liability can reach three times the government's damages, plus a civil penalty for each false claim. The penalty amount is adjusted for inflation every year.
- Whistleblowers can sue. Under the qui tam provisions, a private person, often a current or former employee, can file suit on the government's behalf and receive a share of the recovery, typically between 15 and 30 percent.
How the False Claims Act Connects to DFARS Cybersecurity
The FCA does not need a CMMC certificate to apply. It applies to representations about security that the contractor already makes.
- DFARS 252.204-7012 has required all 110 NIST SP 800-171 requirements since December 31, 2017. Accepting a contract with that clause and billing under it can carry an implied representation that you comply.
- SPRS scores are a direct statement of how many requirements you meet.
- CMMC affirmations under DFARS 252.204-7021 require a senior official to affirm compliance in SPRS annually.
Under the Supreme Court's 2016 decision in Universal Health Services v. Escobar, an implied false certification can create liability when the unmet requirement is material to the government's payment decision. Cybersecurity requirements written into the contract and scored in SPRS are hard to call immaterial.
The DOJ Civil Cyber-Fraud Initiative
On October 6, 2021, the Department of Justice launched its Civil Cyber-Fraud Initiative to use the FCA against contractors that knowingly provide deficient cybersecurity, misrepresent their security practices, or fail to report incidents. The settlements so far:
- Aerojet Rocketdyne, July 2022: $9 million.
- Penn State, October 2024: $1.25 million.
- MORSECORP, March 2025: $4.6 million. The company reported an SPRS score of 104 when its actual score was -142, and used an email provider that did not meet the requirements.
- Raytheon and Nightwing, May 2025: $8.4 million.
- Georgia Tech Research Corporation, September 2025: $875,000.
- LOGZONE, June 18, 2026: $507,144. The company reported an SPRS score of 110. A DIBCAC assessment found -170.
- Honeywell Aerospace, September 1, 2026: $2,042,518, with $375,823 going to the whistleblower.
The pattern is clear. These cases are about the gap between what a contractor said and what it did. Several started with an insider.
Why Your SPRS Score Is Evidence for Hawaii Contractors
Your SPRS score is the number most likely to be compared with reality. The DoD Assessment Methodology starts at 110 and subtracts 5, 3, or 1 point for each unmet requirement, down to a possible -203. A score of 110 says every requirement is met.
In my experience, self-assessed scores are almost always too generous. Contractors give themselves credit for a control because a tool exists, even when it is not configured, documented, or covering every user. Partial credit is narrow. Multifactor authentication covering only remote and privileged users still loses 3 points. Encryption that is not FIPS validated still loses 3 points.
The rules around SPRS changed on February 1, 2026. DFARS 252.204-7019 was eliminated and 252.204-7020 was renumbered 252.240-7997, removing the separate Basic score upload. CMMC self-assessment results and annual affirmations under 7021 are still entered in SPRS, and the scores contractors posted in earlier years are the scores DOJ relied on in the MORSECORP and LOGZONE settlements.
I spent years supporting hedge funds and investment firms in New York, where regulators expected every claim to be backed by documentation. The same standard applies here. If you cannot show the evidence, do not claim the point. That rule sits at the center of how we run CMMC Hawaii engagements: every point in a posted score should trace back to something an assessor can see.
How DFARS Contractors in Hawaii Can Reduce FCA Risk
You reduce FCA risk by making sure what you report matches what you can prove.
- Get an independent gap assessment. Score against all 320 assessment objectives, not a checklist.
- Report the real number. A low score with a credible plan is defensible. An inflated score is not.
- Document gaps in a POA&M with owners and dates.
- Keep your System Security Plan accurate. It should describe the environment you have, not the one you plan to build.
- Check every provider that touches CUI. Cloud services must meet FedRAMP Moderate or equivalent. Your email provider counts.
- Have the senior official understand what they affirm. Leadership has to drive compliance.
- Be ready to report incidents within 72 hours through the DoD Cyber Crime Center (DC3) reporting portal.
- Give employees a way to raise concerns internally and act on them. Whistleblowers often go outside when they feel ignored.
- Correct errors promptly. If you find your posted score was wrong, update it.
Talk to Intech Pacific About Your DFARS Exposure
If you are not sure your SPRS score would survive a DIBCAC review, find out before someone else does. This post is general information, not legal advice. Talk to counsel about your specific situation.
To see how we help contractors in Hawaii and Guam, from a free readiness session to fully managed compliance, visit our CMMC Solutions page.
