Defensible FedRAMP Compliance:
Procurement Integrity is a Critical Part of FedGov Cybersecurity
by: Michael Cardaci
September 4, 2026
Last week, the General Services Administration announced that it has uncovered more than $13 billion in suspected procurement fraud since March 2026 – potentially the agency’s largest finding to date, both in the number of contractors involved and in dollar amount.
While details have not yet been released, GSA has specifically identified cybersecurity false claims as one of the areas it has been reviewing for potential fraud and contractor integrity violations. That is an important recognition of something the federal government and its contractors increasingly need to understand: cybersecurity compliance is not simply an IT concern. It is a critical part of the integrity of the federal procurement system.
A contractor does not necessarily need to experience a cyberattack or suffer a data breach to face legal exposure. Contractors can face False Claims Act liability for knowingly misrepresenting their cybersecurity practices, failing to implement required controls, submitting inaccurate security assessments or scores, or using noncompliant systems while continuing to bill the government.
The Justice Department deserves credit for its Civil Cyber-Fraud Initiative, which has successfully pursued False Claims Act cases against contractors and research institutions that have resulted in millions of dollars in settlements and have demonstrated that cybersecurity obligations embedded in federal contracts can carry significant legal and financial consequences.
- In 2022, Aerojet Rocketdyne agreed to pay $9 million to resolve allegations of cybersecurity violations in federal contracts. The case was brought by a former employee, who received $2.61 million under the FCA's whistleblower provisions.
- In 2024, Penn State agreed to pay $1.25 million to resolve allegations that it failed to comply with cybersecurity requirements in 15 DoD and NASA contracts and subcontracting relationships. Among the government's allegations was that Penn State submitted cybersecurity assessment scores but misrepresented when identified deficiencies would be corrected.
In 2025, the pace and breadth of these cases became even more notable.
- Raytheon, RTX and Nightwing agreed to pay $8.4 million to resolve allegations involving failure to implement required cybersecurity controls on an internal development system used in connection with DoD contracts.
- Health Net Federal Services and its parent company, Centene, agreed to pay $11.25 million to resolve allegations that Health Net falsely certified compliance with cybersecurity requirements under a DoD TRICARE contract, including allegations involving vulnerability scanning and remediation.
- MORSE agreed to pay $4.6 million after the government alleged that it failed to implement required NIST SP 800-171 controls, used a third-party email provider that did not meet required security standards, lacked required system security plans and submitted an inaccurate cybersecurity score.
- And in September 2025, Georgia Tech agreed to pay $875,000 to resolve allegations that it failed to meet cybersecurity requirements on Air Force and DARPA contracts and submitted a false cybersecurity assessment score to the Department of Defense.
These cases involve different organizations, contracts and circumstances. But they share a common lesson: What a contractor tells the government about its cybersecurity posture matters. And so does whether the contractor actually does what it promised.
The common thread is important: the government's concern is not limited to what happens after a cyberattack. It increasingly extends to whether contractors accurately represented their security posture and actually fulfilled the cybersecurity commitments they made in exchange for federal business. That distinction changes how contractors should approach cybersecurity compliance. A certification, assessment score, or security plan is not merely procurement paperwork; it is a representation that can carry legal consequences if it does not reflect operational reality. The False Claims Act's whistleblower provisions further reinforce this accountability by giving employees and others with inside knowledge a mechanism to bring potential misconduct to the government's attention.
Three priorities for combating cybersecurity-related procurement fraud
If the government and the contractors are serious about protecting both taxpayer dollars and sensitive government information, cybersecurity integrity needs to be addressed throughout the entire contract lifecycle.
There are three areas where government and industry should focus.
1. Making sure cybersecurity representations are accurate from the start
The burden begins with industry. Contractors are expected to accurately represent their cybersecurity capabilities, controls, certifications, and limitations when competing for federal business. That includes being candid about what systems and environments are covered, what controls have actually been implemented, what deficiencies remain, and what remediation commitments have been made.
But accountability cannot stop there. Certification bodies, government assessors, consultants, and other partners involved in validating a contractor's cybersecurity posture also have an important role to play. The government needs confidence that an assessment or certification reflects the actual environment
supporting the contract—not an idealized, hypothetical, or narrowly scoped version of it.
A cybersecurity certification should be more than a document in a procurement file. It should be a credible representation of operational reality.
2. Treating cybersecurity compliance as a continuous obligation
Winning the contract is not the finish line. Cybersecurity environments change continuously. Systems are added. Employees change roles. Vendors change. Vulnerabilities emerge. Software reaches end of life. Configurations drift. New requirements become applicable. That means cybersecurity compliance cannot be reduced to an annual assessment or a point-in-time certification.
Federal contractors need continuous monitoring and compliant security operations that can identify when their actual environment begins to diverge from their contractual commitments.
This is where cybersecurity operations become directly connected to procurement integrity. A contractor may have been fully compliant when a contract was awarded. But if it subsequently fails to patch critical systems, maintain required controls, monitor vulnerabilities, properly manage third-party providers or update inaccurate compliance information, the government needs mechanisms to identify that change.
The federal government and its contractors need security operations that continuously demonstrate whether the systems supporting government missions are actually operating within the requirements they have promised to meet.
3. Giving agencies the resources to enforce compliance throughout the contract lifecycle
Finally, the government cannot expect effective cybersecurity oversight without investing in the people, legal authorities, and technology necessary to perform it. Federal agencies need adequate cybersecurity and acquisition personnel who can understand both the technical requirements and the contractual obligations attached to them. They need the legal resources to investigate and pursue credible allegations of fraud and noncompliance. And they need technical capabilities that allow them to move beyond periodic paperwork reviews and gain meaningful visibility into contractor cybersecurity performance throughout the contract lifecycle.
Whistleblowers are an important part of that equation. The FCA's qui tam provisions provide a mechanism for cybersecurity professionals and other individuals with inside knowledge to bring potential misconduct to the government's attention. But whistleblowers should be a safety net – not the government's primary monitoring system. The goal should be to identify cybersecurity compliance failures before an employee has to become a whistleblower, before sensitive information is exposed and before taxpayer dollars are spent on services that do not meet contractual requirements.
The common thread is important: the government's concern is not limited to what happens after a cyberattack. It increasingly extends to whether contractors accurately represented their security posture and actually fulfilled the cybersecurity commitments they made in exchange for federal business.
Procurement integrity and cyber integrity are now connected
The federal government depends on thousands of companies to provide the technology, professional services and mission capabilities that keep government operating. That relationship depends on a basic proposition: when a contractor says it can meet the government's requirements, the government needs to be able to trust that representation and verify ongoing compliance throughout the lifecycle of a contract.
That should not be viewed primarily as a threat to industry. It should be viewed as part of a broader strategy to protect the integrity and resilience of federal missions, and as an incentive to get cybersecurity right.
Contractors need to be proactive in sharing information with government agencies to help them determine risk posture. They also need to be able to document how they are looking forward at cybersecurity and compliance standards and not for the government to tell them. This is the direction.
Contractors that invest in compliant security operations should not have to compete against organizations that cut corners, misrepresent their security posture or treat certifications as simply a paperwork exercise. Strong enforcement can help create a more level playing field—one where good cybersecurity is rightfully treated as a fundamental part of good procurement, and ultimately, good government.