LOGZONE: A Perfect Cybersecurity Score Meets a Government Assessment

The LOGZONE cybersecurity settlement required the contractor to pay $507,144 to resolve allegations that it billed the Navy while knowingly failing to implement required cybersecurity controls. That settlement stands against $682,193 the Navy paid LOGZONE under the two contracts through the March 8, 2025 invoice, according to the settlement agreement. The company had reported a perfect self-assessment score, but a later government assessment placed it near the bottom of the scoring range.

LOGZONE is a logistics services provider based in Huntsville, Alabama. The Justice Department announced the civil settlement on June 18, 2026, over allegations involving two contracts for the Navy’s Naval Oceanographic Command Property Management Program at Stennis Space Center, Mississippi.

The Navy Bought Services With Security Requirements

LOGZONE’s Navy contracts covered logistical and inventory services, as well as facilities support. They required security for the contractor’s covered information systems, including implementation of NIST SP 800-171. That standard concerns protecting controlled unclassified information in nonfederal systems. Here, that meant the systems LOGZONE used for the Navy work that handled defense information.

The government alleged that LOGZONE submitted false claims from May 5, 2021 through March 8, 2025 while required controls remained unimplemented. Some of those missing controls, the government said, could allow significant exploitation of the systems or the removal of sensitive defense information. The allegations also covered missing controls with a narrower effect on the security of the systems and their data. The government’s point: required controls were missing, and the bills kept going out.

We find the contrast hard to miss: perfect on paper, near the bottom when the government checked. The information needing protection was part of the Navy job, and so was the cost of protecting it.

A Perfect Self-Assessment Met a Government Review

LOGZONE submitted a self-assessment score of 110 to the Defense Department’s Supplier Performance Risk System on October 13, 2021, according to the agreement. That was the highest possible score on a scale beginning at -203. On February 2, 2024, the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center completed a Medium Assessment and assigned LOGZONE a score of -170.

The contracts provided for both the company’s self-assessment submission and government Medium or High Assessments. In this case, the agreement puts the company submission beside the later government review, and the government’s alleged billing period continues beyond that review.

The practical question behind an SPRS score and its assessment scope is what the assessment actually covered. We connect the systems handling defense information, the controls the contractor said it had implemented and the evidence behind that statement. The dates then matter because the score describes implementation at a particular point, while invoices keep arriving.

A related problem appeared at MORSECORP. In its civil settlement, the company admitted that it left its reported score unchanged after an independent consultant assessed it much lower, correcting the submission only after a government subpoena. That admission shows why an insider’s knowledge of what happened after an adverse assessment can be as useful as the assessment itself.

The Contract Carried the Cybersecurity Obligation

The safeguarding obligation in LOGZONE’s contracts came through the Defense Federal Acquisition Regulation Supplement. The same contracts also required current self-assessment scores in SPRS and allowed the government to assess implementation. A security requirement, a reported assessment and access for government review all sat inside the contractual bargain.

Defense safeguarding duties predated certification, and the assessment framework introduced in 2020 added SPRS scores and government assessment access. For LOGZONE, the agreement identifies the security and assessment obligations in the Navy contracts themselves.

For an insider, the contract connects technical work to government money. The question we examine is what protections the company owed on the systems doing that work, what it represented about them and what it knew when it sought payment. A discussion confined to certification leaves out the invoices that made these allegations a False Claims Act case.

The Agencies Behind the LOGZONE Settlement

The Justice Department said the security issues were identified when the Defense Contract Management Agency assessed LOGZONE’s implementation of the required controls. The resolution came from a coordinated effort by the Justice Department’s Civil Division and the U.S. Attorney’s Office for the Northern District of Alabama.

That combination connects technical assessment and fraud enforcement. The assessment examined implementation, while the government’s civil allegations concerned claims for payment made with knowledge of unmet contract requirements. An employee who knows what management learned about a missing control may hold a different part of that story from the assessor who recorded the technical finding.

What Evidence Is Needed to Prove Fraud?

For these allegations, the useful evidence connects contract requirements, actual controls, company knowledge and Navy claims. LOGZONE’s agreement supplies that structure: systems handling defense information, a reported self-assessment, a later government assessment and reimbursement claims during the alleged noncompliance. We work with insiders to connect what they saw to those decisions and payments.

If your work involved the assessment, you may know which systems and controls it described. If you worked on remediation or billing, you may know what remained unfinished when the company sought payment. Those perspectives can explain the relationship between a score, the work behind it and the government’s bill.

Defense contractors with compliance and ethics programs had higher penalties relative to obligated contract dollars in a 2022 International Journal of Management and Humanities study of 49 contractors. The study used a nonrandom sample and data from 2014 through 2019, and found no statistically significant difference in dollars obligated between the groups. For the insider reading this case, the useful question remains concrete: what did the company do when the people examining its systems found missing controls?

The Settlement Also Reached the Company’s Cost Accounts

The agreement designated $253,572 of the settlement as restitution. It also barred LOGZONE from charging the government, directly or indirectly, for specified costs tied to the settlement, including the investigation, defense, corrective actions in response to the government’s audits and civil investigations, and the settlement payment itself.

The agreement required LOGZONE to identify and repay any such costs it had already submitted for payment. That makes the accounting treatment relevant to an insider too: the company had to keep those costs off government contracts and correct any earlier charges. The settlement expense could not simply come back to taxpayers through another bill.

You Know the Systems Behind the Score

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. If the compliance statement and the systems you worked on tell different stories, speak to one of our Whistleblower Experts about the Navy work behind the score. We build the case with you, bring in cybersecurity fraud whistleblower lawyers who understand defense contracts, and stay beside you as the case moves forward.