False Cybersecurity Certifications on Civilian Federal Contracts: Known Gaps and Promised Fixes

A civilian contractor cybersecurity false certification can support a False Claims Act case when the contractor knowingly misrepresents the security work it promised the government. You may know which controls were missing, what the assessment disclosed and whether anyone pursued the promised fixes. The question is what the contractor told the government about the work you know from the inside.

What Is a False Certification?

A false cybersecurity certification tells the government that required protections are in place, or will be by a stated date, when the contractor knows otherwise. The false promise can concern missing controls, work to correct known deficiencies or the security practices used to perform the contract.

For a civilian agency contract, the starting point is the security work that agency actually bought. We connect the contractor’s statement to the contract requirements and the system it described. A promise to fix a known gap deserves as much attention as a claim that the gap has already been closed.

What the Civil Cyber-Fraud Initiative Pursues

The Justice Department’s Civil Cyber-Fraud Initiative targets knowingly deficient cybersecurity products or services, knowing misrepresentations of cybersecurity practices and knowing violations of incident-monitoring or reporting obligations.

For an insider, those are different places to see a discrepancy. The work delivered may fall short of the contractual promise. An assessment may disclose missing controls while the accompanying commitment to fix them misrepresents what the contractor will do. A reporting obligation concerns what the agency learns when an incident occurs. The contract and the communications identify which promise is at issue.

Penn State’s Known Gaps and Promised Corrections

The Pennsylvania State University agreed to pay $1,250,000 in October 2024 to resolve allegations involving fifteen NASA or Department of Defense contracts and subcontracts. The Justice Department’s settlement announcement describes alleged failures from 2018 through 2023 to implement required cybersecurity controls and adequately develop and carry out plans to correct identified deficiencies.

The allegations reached beyond the discovery of a missing control. The government said Penn State knew of deficiencies and failed to follow through on the corrective work. That puts the people who assessed the systems, planned the work and represented its status close to the central issue.

The Alleged Deception Was in the Promised Dates

The government said Penn State’s assessment scores disclosed that certain controls were missing. It alleged deception about the dates by which the university would implement them and the corrective work it would pursue. Its description is unusually specific:

Justice Department, Penn State settlement announcement, October 22, 2024

An acknowledged deficiency can sit beside a misleading promise to correct it. The assessment tells the government where the gaps are. The promised implementation dates tell it when those gaps will close. The alleged failure to pursue the work makes the second representation worth examining just as closely as the first.

For someone working on the systems, the useful comparison is the commitment sent outside the organization against the corrective work inside it. Which controls did the assessment identify? What completion dates did the university represent? What did the people responsible for implementation actually do? Those questions connect the technical shortfall to the promise.

The Cloud Provider Was Part of the Security Allegation

The government also alleged that Penn State used an external cloud service provider that failed to meet Defense Department security requirements for covered defense information on certain contracts and subcontracts. That allegation concerns the provider used to perform the work, alongside the university’s own implementation and corrective plans.

For a civilian contract involving a cloud provider, we examine the requirement incorporated into that purchase, the service actually used and the representation made about it. The provider’s role belongs in the same comparison as the contractor’s own controls.

The whistleblower who brought the case was the former chief information officer of Penn State’s Applied Research Laboratory. The role matters: someone responsible for the technology can see how an assessment, an implementation commitment and the work on the system fit together.

Aerojet’s Cybersecurity Representations Reached NASA Work

Aerojet Rocketdyne agreed to a $9 million settlement in July 2022 over allegations that it misrepresented compliance with cybersecurity requirements in federal contracts. It supplied propulsion and power systems for launch vehicles, missiles, satellites and other space vehicles to the Department of Defense, NASA and other federal agencies.

A former employee brought the whistleblower case. The central allegation concerned what Aerojet represented about its contractual cybersecurity compliance.

The government buys the promised protection along with the work. Taxpayers bear the cost when a contractor knowingly misrepresents that protection. Penn State’s allegations show the particular absurdity: an assessment can disclose the gaps while the promise to close them misleads the customer.

Hill’s Alleged Billing for Unevaluated Cybersecurity Work

Hill Associates allegedly billed for cybersecurity work without the required technical evaluation under its General Services Administration schedule IT services contract. That is a question about the service sold and the evaluation required to sell it. It belongs beside, but separately from, allegations about the security controls operating on a contractor’s systems.

The Justice Department’s July 2025 announcement described a settlement of at least $14.75 million, with additional payments tied to specified financial contingencies. It covered multiple allegations concerning work from 2018 through 2023.

What Proof Do You Need as a Whistleblower?

The useful evidence connects what the contractor promised, what happened on the system, who knew and what the government paid for. You may know who identified the gap, who chose the implementation date or who approved the statement sent to the customer. We put those connections together with you, using the assessment, the corrective plan and the work behind them.

The promise may also pass through a subcontract. Where a supplier’s statement feeds into a prime contractor’s invoice, we trace that connection to the government purchase. What the contractor knew when it made the promise is part of the case.

HHS Auditors Found Gaps in Incident Reporting

Auditors at the Department of Health and Human Services found failures both in contractors’ reporting and in the reporting language included in contracts. The agency’s Fall 2025 oversight report describes a review of fourteen information and communications technology service contracts. Four contractors reported ten cybersecurity incidents, but two of those contractors failed to report an identified incident within the required time. Eight of the reviewed contracts lacked required language on reporting suspected or confirmed incidents and breaches.

The findings show why the contract and the incident report need to be read together. The reporting language states the obligation, while the incident and notification dates show what happened. The inspector general said these failures could leave HHS unaware of an incident and deprive it of an early opportunity to reduce the risk.

We examine a suspected false certification by connecting the applicable obligation, what the contractor represented, who knew the facts and the government payment. The audit gives a concrete reason to examine the reporting promise as carefully as the technical controls.

How Much Money Can a Whistleblower Get From a Qui Tam Lawsuit?

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. In the Aerojet case, the Justice Department announced that the former employee would receive $2.61 million as a share of the recovery.

You Know Whether the Fixes Happened

If you know why the security work fell short of what the contractor promised, speak with our whistleblower experts about that gap. We build your strongest cybersecurity whistleblower case with you, from the technical facts through the contract and the money, and bring in civilian cybersecurity whistleblower lawyers who understand the promise at issue. You bring the inside knowledge, and we stay beside you as your partners through the case.