The Department of Justice recently announced that Georgia Tech Research Corporation (GTRC) has agreed to pay $875,000 to resolve allegations that it violated the False Claims Act by failing to meet required cybersecurity standards in connection with contracts with the U.S. Air Force and the Defense Advanced Research Projects Agency (DARPA).
In light of this development, government contractors would be well advised to review their cybersecurity programs, ensure the accuracy of their self-assessments, and prepare for heightened oversight under the Cybersecurity Maturity Model Certification (CMMC) program.
Alleged Failures and Misrepresentations
GTRC manages sponsored research agreements on behalf of the Georgia Institute of Technology (Georgia Tech), including research contracts with the U.S. Department of Defense (DoD). According to the government, GTRC and Georgia Tech failed to implement critical cybersecurity controls while conducting sensitive cyber-defense research, misrepresented their compliance posture, and submitted false information to DoD regarding their cybersecurity readiness.
Specifically, the government alleged that until December 2021, GTRC and Georgia Tech:
- Failed to install, update, or run required anti-virus or anti-malware tools on desktops, laptops, servers, and networks at Georgia Tech’s Astrolavos Lab.
- Did not have a system security plan in place until at least February 2020, despite contractual requirements to maintain one.
- Submitted a false...
Read Full Story:
https://news.google.com/rss/articles/CBMirwFBVV95cUxNLTZkSzNMNXN5WkdfZlA4cS0z...