×
Monday, May 18, 2026

District Court confirms that noncompliance with cybersecurity requirements may lead to False Claims Act liability - Lexology

As we have previously noted, the federal government has increased its focus on identifying fraud related to the cybersecurity obligations of government contractors. A recent district court decision may support this government initiative, as the court held that a contractor’s knowing failure to disclose gaps in its cybersecurity compliance could lead to liability under the False Claims Act.

In United States ex rel. Markus v. Aerojet Rocketdyne Holdings, Inc.,[1] the US District Court for the Eastern District of California evaluated a relator’s claim that a contractor fraudulently induced the government to award seven contracts by making false statements about the contractor’s compliance with the cybersecurity requirements delineated in Defense Federal Acquisition Regulation Supplement 252.204-7012 and NASA Federal Acquisition Regulation Supplement 1852.204-76. The contractor argued that it had not made false statements because it had disclosed to the government that it was not fully compliant with those clauses.

The district court concluded that, on summary judgment, it could not determine whether the cybersecurity requirements were “material” under the False Claims Act. It stated that, although the contractor had disclosed some information regarding noncompliance with the cybersecurity requirements to the government, the extent of the disclosures was unclear, and the government may not have had the “full picture” of the contractor’s noncompliance. The district court...



Read Full Story: https://www.lexology.com/library/detail.aspx?g=90b2f6cb-1fa6-48b4-aaf7-766227...