December 2026 | SPOTLIGHT | RISK MANAGEMENT
Financier Worldwide Magazine
December 2026 Issue
Cyber security is no longer just an IT issue; for companies doing business with the government, it is now a source of False Claims Act (FCA) liability.
Since launching its Civil Cyber-Fraud Initiative in October 2021, the Department of Justice (DOJ) has used the FCA to pursue contractors and suppliers that allegedly misrepresent their compliance with federal cyber security requirements.
Many of these cases began with whistleblowers – in FCA parlance, ‘relators’ – often current or former IT security personnel. Meanwhile, the requirements themselves have been shifting through the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) programme, new obligations for federal contract recipients, and proposed government-wide rules, such as the FAR Controlled Unclassified Information (CUI) Rule.
The gap between government-facing representations and actual security practices drives cyber security FCA exposure. A security deficiency can become a fraud allegation when a company seeks federal funds while knowingly making, or causing, a materially false or misleading representation about its compliance.
That exposure extends beyond defence contractors to universities, healthcare administrators, manufacturers and, where their own conduct supports liability, owners and investors. A successful cyber attack is not a prerequisite.
How cyber security failures become FCA cases
...
December 2026 | SPOTLIGHT | RISK MANAGEMENT Financier Worldwide Magazine December 2026 Issue Cyber security is no longer just an IT issue; for companies doing business with the government, it is n...