Penn State: A Date on a Form Is Not a Fix

In the Penn State cybersecurity settlement, the university agreed to pay $1,250,000 to resolve allegations of missing contract-required safeguards, false remediation dates and cloud services that failed defense security requirements. If you assessed the systems or worked on the promised fixes, the central question is familiar: did the commitment sent to the government match the work inside?

The Justice Department announced the settlement on October 22, 2024. It covered fifteen contracts or subcontracts involving the Defense Department or NASA. The former chief information officer of Penn State’s Applied Research Laboratory brought the whistleblower case.

What the Government Alleged

The government alleged that, between 2018 and 2023, Penn State failed to implement cybersecurity controls required by its defense and NASA contracts and failed to adequately develop and implement plans to correct identified deficiencies. The government also challenged the external cloud service used in performing certain contracts and subcontracts.

The Justice Department alleged that Penn State submitted cybersecurity assessment scores that reflected missing controls, misrepresented the dates by which it would implement those controls and failed to pursue plans of action to do so. The promised correction was itself part of what the government said was false.

What the Whistleblower Alleged

The former laboratory CIO’s first amended complaint described what an internal review found behind the submissions. He alleged that a team gathered contract information and compliance records in June 2022 and found that Penn State had falsely attested to compliance since January 2018.

His account of the records submitted to the defense assessment system was blunt:

The complaint alleged that the records named colleges or institutes generically instead of identifying specific systems or research computing spaces. It also alleged that the uploaded risk assessments were merely templates and that no proper risk assessment had been performed. Those are concrete discrepancies an insider can explain: what the submission claimed to assess and what work actually supported it.

The whistleblower also alleged that a research executive instructed him to tell a university committee about the investigation without sharing its results. He said he later refused her requested edits to the team’s report because it was meant to convey the gravity of the university’s situation.

Why the Remediation Date Mattered

The Penn State cybersecurity remediation settlement addressed allegedly false promises about when missing safeguards would be implemented. The government alleged that the university did not pursue the plans behind those dates. We see a promise of a fix standing in for the fix itself.

The defense assessment framework uses Supplier Performance Risk System scores to assess compliance with NIST SP 800-171 security requirements. The score describes the system’s safeguards. The remediation date says when the missing ones will be implemented. An insider may know both what the assessment disclosed and what happened to the plan afterward.

We would examine the submitted assessment and promised date alongside the plan of action and evidence of actual implementation. A security specialist may know whether a control was implemented on the system covered by the assessment. Someone managing the work may know what happened to the commitment to fix it. Together, those accounts can connect the statement made outside the organization to decisions made inside it.

The management side matters as much as the technical description. The 2026 University of California, Davis paper Pathways to Protection: An Organization-Centered Approach to Whistleblowing Law puts it plainly:

For a remediation promise, that perspective turns attention to who committed to a date, who was responsible for the work and what they actually did. We use it to understand the decisions behind a security statement that accompanies government-funded work. An insider who knows that history can explain much more than the assessment number alone.

The Cloud Provider Was Part of the Contract

The government alleged that Penn State did not use an external cloud service provider meeting defense security requirements for covered defense information when performing certain contracts and subcontracts. The cloud arrangement was therefore part of the alleged failure to perform the funded work as required.

The May 2024 defense safeguarding clause required covered cloud services to meet FedRAMP Moderate-equivalent security and incident-related requirements. Applicable duties also flowed to subcontractors handling covered defense information or providing operationally critical support.

The whistleblower’s complaint supplied a specific cloud example: Penn State’s move from Box to the commercial version of Microsoft Office 365 OneDrive. He alleged that controlled government information had migrated to a platform that did not meet the requirements, and that work tickets showed controlled research configured within that commercial environment. For a cloud insider, those tickets can connect a security claim to the service actually handling the information.

An outside service also figured in the Aero Turbine and Gallant Capital Partners settlement, announced in July 2025. There, the government alleged that the companies supplied sensitive defense information to a software company in Egypt and its unauthorized foreign personnel. That case concerned who could reach the information. Penn State’s cloud allegation concerned whether the provider met the required security standard.

The government credited Aero Turbine and Gallant for written self-disclosures, cooperation and prompt remedial action. In Penn State’s case, the government alleged that the promised corrective work was not pursued.

The Whistleblower Case Behind the Settlement

The former laboratory CIO brought the case under the False Claims Act’s whistleblower provisions, and the government later joined for settlement purposes. The Justice Department described the resolution as part of its Civil Cyber-Fraud Initiative, which targets knowingly deficient cybersecurity products or services, false security representations and failures to meet incident-monitoring and reporting obligations.

The agreement provided for the former CIO to receive a share of the settlement. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Our work with defense contractor whistleblowers starts with the connection between what they know and what the government was told about the work it funded.

What Evidence Is Needed to Prove Fraud?

For a case about cybersecurity remediation, the useful evidence connects the contract, the assessed system, the reported score, the promised correction and the work actually performed. The connection to government payment gives those records their significance. We examine the representation alongside the award, invoice or payment it supported, with the specific system and contractual obligation in view.

Assessment staff may understand the scope behind the score and the basis for reporting a control as implemented. People responsible for remediation may know whether the promised work reached the covered system. Staff working with the cloud provider may know which service handled the information and what supported the claim that it met the required standard. Those are different views of the same commitment.

You Know What Happened to the Promised Fix

If you know why a remediation date, assessment or cloud-security statement did not match the work, talk with our whistleblower experts. We build the case with you and bring in cybersecurity fraud whistleblower lawyers who understand defense research contracts and the systems behind the submissions. We stay beside you as your technical knowledge becomes a case about the government’s money.