DoD Cybersecurity Whistleblower / CMMC Qui Tam Risk: What Defense Contractors Should Verify Before They Certify

On June 18, 2026, a Huntsville logistics contractor named LOGZONE agreed to pay $507,144 to the United States. The Justice Department’s announcement describes no breach — nobody is alleged to have stolen anything. The problem was a number: in October 2021 the company reported a perfect self-assessment score of 110 in the Pentagon’s supplier system, and in 2024 a government assessment scored the same environment at negative 170, 280 points lower. That gap is the case.

Here’s the bottom line. “DoD cybersecurity whistleblower / CMMC qui tam” risk is real, it is active, and it is almost never about being hacked. It’s about a cybersecurity statement — an SPRS score, a CMMC affirmation, a System Security Plan, a proposal certification, a subcontractor attestation — that you cannot back up with evidence. The False Claims Act lets the government, and private whistleblowers acting on its behalf, pursue contractors who knowingly make false statements tied to government payments or contract eligibility (31 U.S.C. § 3729). In fiscal year 2025, DOJ reported roughly $52 million across approximately nine cybersecurity False Claims Act settlements, and the trend is accelerating.

If something just happened — an employee raised a concern, a prime demanded proof, an executive is about to click “affirm,” or you found a score that doesn’t add up — the next section tells you exactly where to start. We’ll be honest about what this page can and can’t do for you, walk through the DOJ cases that define the risk, and map your situation to the next correct step. No fear-mongering. Just the primary sources and a clear path.

Which situation are you in? Start here.

Different triggers need different first moves. Find yours, then read the section it points to.

This page is built mostly for the defense contractor side — the owner, CISO, IT director, FSO, contracts officer, or compliance lead asking “could one of our statements be used against us, and what do we fix first?” If you’re an employee weighing whether to report your employer, we serve you too — honestly, and without a sales pitch — in a dedicated section below.

What we actually verified for this guide

Can a DoD cybersecurity whistleblower bring a CMMC qui tam case?

Yes. A cybersecurity insider can bring a “qui tam” case — a whistleblower lawsuit under the False Claims Act, where a private person (a “relator”) sues on the government’s behalf and shares in any recovery (31 U.S.C. § 3730). But “CMMC qui tam” is shorthand, not a separate bounty program. The exposure comes from knowingly false or unsupported cybersecurity statements tied to government payment, award eligibility, or contract performance.

Qui tam is older than the Pentagon. The phrase is Latin, the statute dates to the Civil War, and the mechanics are simple: an individual with knowledge of fraud against the United States files a complaint under seal in federal court, hands the government a written disclosure of their evidence, and the Department of Justice decides whether to take over the case. If the government joins (“intervenes”), the relator collects 15% to 25% of the recovery. If the government declines, the relator can proceed alone and collect 25% to 30%.

What changed is the subject matter. In October 2021, the Department of Justice launched its Civil Cyber-Fraud Initiative, announcing it would use the False Claims Act against contractors and grant recipients that knowingly provide deficient cybersecurity, knowingly misrepresent their security practices, or knowingly fail to report incidents (DOJ). DOJ has made clear that this initiative is not going away — and in January 2026, Deputy Assistant Attorney General Brenna Jenny stated at an industry conference that these cases are “not about data breaches” but are instead “premised on misrepresentations.”

The numbers show the trend is accelerating. In fiscal year 2025, DOJ’s False Claims Act statistics reported a record $6.8 billion in total recoveries and an all-time-high 1,297 new qui tam suits; cyber-fraud cases accounted for roughly $52 million across about nine settlements, and DOJ reported that cyber-fraud recoveries have more than tripled in each of the last two years (DOJ FY2025 statistics).

Is CMMC noncompliance itself a False Claims Act violation?

Not automatically. The False Claims Act targets knowingly false claims, records, or statements that are material to government payment — not honest imperfection. Noncompliance becomes dangerous when it’s paired with a proposal, invoice, SPRS score, CMMC affirmation, SSP, or attestation that doesn’t match reality, and the evidence shows the company knew or recklessly disregarded the gap (31 U.S.C. § 3729).

There are three very different situations, and only two of them are real problems:

• Imperfect compliance, honestly documented. You have open gaps, they’re in your Plan of Action and Milestones (POA&M), your score reflects reality, and you’re working the plan. This is a compliance problem. It is normal. It is not fraud.
• An unsupported official statement. You told the government — through a score, an affirmation, a certification, or a claim for payment — that you met requirements you couldn’t back up at the time you said it. This is where False Claims Act risk lives.
• A known gap plus continued false statements. You knew the statement was wrong and kept making it. This is the highest-risk posture, and it’s where the largest settlements come from.

The engine behind all of this is the word “knowingly.” Under 31 U.S.C. § 3729(b), it means actual knowledge, deliberate ignorance, or reckless disregard for the truth. You do not need to intend to defraud anyone. “We were optimistic” is not a defense if the evidence shows you should have known better. And there does not need to be a breach.

So the question to ask about every external cybersecurity statement your company makes isn’t “are we perfect?” It’s: does this statement claim more than our evidence can prove today?

Why this matters specifically for CMMC

CMMC makes the control set identifiable, which makes the comparison easy for anyone — a prime, a C3PAO, the Defense Contract Management Agency, or a whistleblower. CMMC Level 1 covers Federal Contract Information (FCI) and requires the 15 basic safeguards in FAR 52.204-21, checked by an annual self-assessment. CMMC Level 2 covers Controlled Unclassified Information (CUI) and requires the 110 security requirements in NIST SP 800-171 Revision 2, organized into 14 control families, via self-assessment or C3PAO certification depending on the contract. CMMC Level 3 adds requirements from NIST SP 800-172 and is assessed by DCMA DIBCAC. The rule is at 32 CFR Part 170. One precision note: for CMMC purposes, Level 2 maps to NIST SP 800-171 Revision 2 — not Revision 3, which NIST has published in its own publication line but DoD has not adopted for CMMC.

What changed when CMMC became contractual?

The CMMC Program Rule took effect under 32 CFR Part 170 on December 16, 2024, and the DFARS rule that puts CMMC into contracts took effect November 10, 2025. Together they turned certain cybersecurity statements into conditions of contract award, visible to contracting officers through SPRS. Some of your security claims are no longer vague readiness talk — they’re award-eligibility facts.

This is the structural shift that took cyber-FCA risk from “theoretical” to “operational.” The chain below shows exactly how an internal security claim becomes a government-relied-upon representation.

The CMMC Contractual Representation Chain

A few of those clauses deserve a plain-English note. DFARS 252.204-7021 requires contractors to achieve and maintain the required CMMC status, submit and update CMMC UIDs in SPRS, file annual affirmations of continuous compliance, and close out POA&Ms. DFARS 252.204-7025 provides that an offeror is not eligible for award unless it has a current CMMC status and a current affirmation in SPRS for each applicable system. DFARS 204.7503 directs contracting officers to check SPRS and not award, exercise an option, or extend performance without a current status posted at the required level.

One timing fact to keep in front of leadership: Phase 1 runs November 10, 2025 through November 9, 2026, focused largely on Level 1 and Level 2 self-assessment requirements and affirmations in solicitations. Phase 2 enforcement begins November 10, 2026, when third-party (C3PAO) certification requirements expand for contractors handling CUI (Federal Register, DFARS final rule). The clock is real, and it’s in the rule.

Which cybersecurity claims create the most CMMC qui tam risk?

The highest-risk claims are the ones someone can compare against your records: SPRS scores, CMMC affirmations, SSP scope, POA&M status, cloud and external-provider responsibilities, incident-reporting obligations, subcontractor attestations, and proposal certifications. Risk climbs when internal evidence shows the statement was unsupported when it was made.

The DCR CMMC Qui Tam Risk Map

Last verified: June 2026

The pattern across every row is the same: a requirement existed, a statement was made, the statement mattered to money or eligibility, and the evidence didn’t match.

What DOJ cyber-fraud cases should defense contractors study?

DOJ’s cyber-fraud cases show the risk isn’t limited to big primes, classified work, or actual breaches. The recurring fact pattern is a cybersecurity obligation, a statement tied to government money, and evidence the contractor knew its claim didn’t match its controls. The cases below are the ones to know — several were driven by whistleblowers, and the settlements run from roughly $421,000 to nearly $15 million.

We keep this table current because it’s the clearest possible answer to “is the government really doing this?”Each case links to its DOJ source. Settlements resolve allegations — none of these involve a court determination of liability.

What these cases have in common

Five threads run through nearly all of them. One: a cybersecurity requirement existed in the contract. Two: a representation was made or implied. Three: that representation mattered to payment, award, or performance. Four: internal or third-party evidence contradicted it. Five: DOJ treated the mismatch as more than a technical compliance issue. Notice what’s noton that list — a breach. The government recovered in these cases on the strength of the misrepresentation alone.

What these cases do not prove

They don’t prove that every CMMC gap is fraud, that every inaccurate score creates liability, or that every whistleblower complaint is valid. They prove that your cybersecurity representations are now enforcement evidence — and that the trigger is often an assessment (DCMA/DIBCAC in LOGZONE) or an insider (a former cybersecurity director in Aerojet, the head of security in MORSECORP), not a hack. For the full penalty picture, see Can You Get Sued for False CMMC Certification? and our guide to CMMC non-compliance penalties.

How much a whistleblower can actually recover

How do damages get large enough to make a 20% share meaningful? The False Claims Act authorizes treble (3×) damages plus a civil penalty of $14,308 to $28,619 per claim for penalties assessed after July 3, 2025 (Federal Register; 31 U.S.C. § 3729). When one contract generates many invoices, the per-claim penalties stack fast.

What should you do if an employee or subcontractor raises a CMMC whistleblower concern?

Treat it as a legal and compliance triage event, not an IT disagreement. Preserve the records, stop making new unsupported statements, do not retaliate, separate fact-finding from remediation, and involve qualified counsel before you decide whether to correct, disclose, or communicate externally. The False Claims Act protects employees, contractors, and agents from retaliation for lawful efforts to stop a violation (31 U.S.C. § 3730(h)).

The first 24 hours matter more than most leaders realize, because the way you respond can either contain the problem or hand a future relator a retaliation claim on top of the underlying one. Retaliation exposure under § 3730(h) is separate from the cybersecurity issue, and its remedies include reinstatement, two times back pay, interest, and special damages plus attorneys’ fees. You can get the cyber question right and still lose badly by mishandling the person who raised it.

The first-24-hours checklist

What not to say internally

Certain sentences create discoverable panic and blame, and they show up in complaints. Strike them from your vocabulary the moment a concern is raised.

• “Delete that.”
• “We can fix it after award.”
• “Everyone does this.”
• “Just sign it.”
• “Don’t put that in writing.”

What to document instead

• “We are preserving the record.”
• “We are pausing unsupported external statements.”
• “We are verifying scope, score, SSP, and POA&M.”
• “Legal and compliance are reviewing before any correction or disclosure.”

How do you check whether a SPRS score or CMMC affirmation is supportable?

A supportable SPRS score or CMMC affirmation needs more than a spreadsheet number and executive confidence. It should trace to assessment scope, SSP version and date, CAGE codes, control-by-control evidence, POA&M status, and any external-provider responsibility documentation. SPRS itself stores the assessment score, date, scope, CAGE codes, SSP name/version/date, and POA&M date.

Before an affirming official signs, the company should be able to put the following in front of them. If a line is missing, the statement may be claiming more than the evidence proves — and that’s the gap DOJ looks for. For a full deep dive on what the signer is actually committing to, see our guide to CMMC annual affirmation legal liability.

The evidence packet before anyone affirms or certifies

How do DFARS 252.204-7019 and -7020 turn a self-assessment score into evidence?

DFARS 252.204-7019 and -7020 are the score-posting backbone for NIST SP 800-171 self-assessments — they pre-date CMMC and already require the score to live in SPRS. 7019 conditions award eligibility on having a current NIST SP 800-171 assessment posted in SPRS; 7020 requires you to keep it current, give DoD access for higher-level assessments, and confirm your subcontractors have results posted too.

This is why a self-assessment score is never just an internal worksheet. Once it’s in SPRS, it’s a dated representation the government relies on — and one DIBCAC can come back and re-score. The LOGZONE matter is the live demonstration: the Navy contracts required the company to implement NIST SP 800-171 controls and report its assessment score through SPRS, the company posted a 110, and a later DIBCAC assessment put the real number at −170. The score range itself, −203 to +110, is now part of a DOJ press release. For more on how scores are used as evidence, see our walkthrough of what happens if you lie on your SPRS score and penalties for an inaccurate SPRS score.

Which provider category helps: lawyer, RPO, MSSP, GRC platform, CUI enclave, or C3PAO?

If there’s a whistleblower complaint, a subpoena, a possible false statement, a retaliation concern, or a disclosure question, start with qualified counsel. If the problem is evidence, scope, SSP, POA&M, controls, or environment design, the next category is usually an RP/RPO, an MSSP or vCISO, a GRC platform, or a CUI enclave provider — not a C3PAO. The assessor is rarely your first remediation call.

Quick definitions: a C3PAO (Certified Third-Party Assessment Organization) performs the formal Level 2 certification assessment; an RP/RPO (Registered Practitioner / Registered Provider Organization) provides readiness and advisory help; an MSSP and a vCISO run operational security; a GRC platform manages evidence and control mapping; and a CUI enclave is a controlled, scope-reducing environment for sensitive data.

When is a C3PAO the wrong first call?

A C3PAO is the right call when you’re ready for a formal assessment or need assessment-path clarity — not when you need the same organization to remediate the environment it will then assess. CMMC ecosystem conflict rules require avoiding actual or perceived conflicts of interest: an ecosystem member generally may not participate in a Level 2 certification assessment if it served as a consultant preparing that organization for a CMMC assessment within the previous three years (32 CFR Part 170). Keep readiness help and formal assessment cleanly separated. Verify current Cyber AB ecosystem conflict rules before engaging any provider.

What if you already submitted an inflated score or unsupported affirmation?

Don’t quietly overwrite the record and hope it disappears. Preserve the facts, involve counsel, identify the affected contracts and statements, evaluate your correction or disclosure options, and remediate against the current requirements. DOJ has credited timely self-disclosure, cooperation, and prompt remediation — the Aero Turbine/Gallant settlement is the example.

There’s a wrong way and a safer way, and the difference can be the difference between cooperation credit and a much larger number.

The wrong way: edit records without preserving prior versions; blame one employee before reviewing the evidence; keep submitting proposals on the same unsupported claim; tell staff not to write things down.

The safer sequence: preserve → legal/privilege triage → contract and clause mapping → evidence review → a correction or disclosure decision with counsel→ a remediation plan → controls on future statements.

The statute itself rewards candor. Under 31 U.S.C. § 3729(a)(2), a defendant who furnishes the government all known information about a violation within 30 days of discovering it, fully cooperates, and acts before any action commences may have damages reduced from treble to double. Whether and how to disclose is a legal decision — but the law is built to make honesty cheaper than concealment.

What does this mean for small manufacturers, machine shops, SBIR firms, and subcontractors?

Small size doesn’t remove cyber-FCA risk when contract clauses, CUI, FCI, or DoD supply-chain obligations apply. DOJ’s cyber-fraud settlements already include suppliers and subcontractor-related facts — the Swiss Automation machining case and MORSECORP’s SPRS-score case among them.

For small DIB suppliers, the danger usually isn’t bad intent — it’s evidence maturity. You’re trying to win or keep work, and the paper trail behind your claims is thin. That’s a fixable problem, and fixing it early is far cheaper than litigating it later.

Small DIB cyber-FCA risk by business type

The realistic path is the same across all of them: determine whether you handle FCI only, CUI, or both; identify the required level from the contract clause (not a vendor’s checklist); build the SSP and the evidence before you make claims; consider a limited-scope CUI enclave if your environment is sprawling; and never let sales or business development answer a compliance questionnaire on their own.

Companion guides that go deeper: CMMC for small business, CMMC for subcontractors, CMMC for machine shops, CMMC Level 2 cost, CMMC self-assessment vs C3PAO, and the CMMC annual affirmation guide.

If you’re the one who saw something: your options as a whistleblower

If you’re an insider who believes your employer is misrepresenting its cybersecurity compliance to the government, the False Claims Act may let you file a qui tam case and share in any recovery — but the process is technical, the protections matter, and your first call should be a qualified False Claims Act (qui tam) attorney. This publication is not a law firm, we don’t give legal advice, and we will not route you to a vendor.

We built most of this page for contractors, but the search that brought some of you here is different, and you deserve a straight answer too.

How the process works. You (or your attorney) file a complaint under seal in federal court and serve it only on the government, along with a written disclosure of substantially all your material evidence (31 U.S.C. § 3730(b)). The Department of Justice gets at least 60 days— routinely extended — to investigate and decide whether to intervene. The case stays secret from your employer until the court unseals it. If the government joins, it takes the lead and you remain a party. If it declines, you can proceed on your own.

What you can recover. A successful relator receives 15%–25% if the government intervenes and 25%–30% if it declines and you prevail (31 U.S.C. § 3730(d)), plus your attorneys’ fees and costs from the defendant. In cyber cases, real awards have ranged from about $201,250 (Georgia Tech) to $2.61 million(Aerojet). Aerojet’s relator was a former cybersecurity director whose complaint described being terminated after he refused to sign off on the company’s compliance and raised his concerns internally — the kind of fact pattern that also triggers anti-retaliation protection.

The protection you have. The False Claims Act protects employees, contractors, and agents from being fired, demoted, harassed, or otherwise retaliated against for lawful efforts to stop a violation (31 U.S.C. § 3730(h)) — and that protection covers good-faith efforts even before a suit is filed. Remedies include reinstatement, double back pay, interest, special damages, and fees.

The honest part most relator-recruitment pages skip. Most qui tam cases are hard, and many never produce a dollar for the relator; the government joins only a minority of them, cases routinely sit under seal for years, and two doctrines can extinguish a claim before it’s heard — the first-to-file bar (only the first relator to file on a set of facts may proceed, 31 U.S.C. § 3730(b)(5)) and the public-disclosure bar (you generally can’t sue on facts already public, unless you’re an “original source,” 31 U.S.C. § 3730(e)(4)). There’s also a statute of limitations: the later of six years after the violation or three years after the government knew the facts, capped at ten years (31 U.S.C. § 3731(b)). None of this is meant to discourage you — it’s meant to set your expectations honestly, which is exactly what the marketing pages won’t.

What to bring to a False Claims Act attorney.Organize what you legitimately have access to — and do not take anything you aren’t authorized to take. Helpful materials include documentation of what was represented to the government versus the real posture, who knew, when they knew, and the timeline. Then ask the attorney about contingency-fee terms, their experience with Civil Cyber-Fraud cases specifically, the seal process, and your own retaliation exposure.

The honest limits of this page

This is a decision resource, not legal, contractual, or compliance advice. It can’t tell a whistleblower whether to file, tell a contractor whether it has liability, or replace a qualified attorney, RP/RPO, or C3PAO where those roles are required. Its job is to help you identify the next category of help before you make the problem worse.

Call counsel first if:an employee or former employee alleges fraud; you receive a subpoena, Civil Investigative Demand, or an inquiry from DOJ, DIBCAC, DCMA, an Inspector General, or a prime; you suspect a false SPRS score or affirmation; there’s a retaliation concern; you face a disclosure or correction decision; or you’re in an acquisition or due-diligence situation where successor liability is in play.

A provider-category path is appropriate when:you know the issue isn’t a legal dispute yet, and you need to build evidence, remediate controls, reduce CUI scope, or prepare for a future assessment.

The mindset we’d urge on any leader reading this: don’t panic, and don’t paper over it. The contractors who handle this well are the ones who get honest about the gap early, preserve the record, and route each piece of the problem to the right kind of help.

Frequently asked questions

What to do next

Pick the path that matches your problem. If there’s legal, whistleblower, or false-statement risk, your first call is qualified counsel. If your issue is evidence, scope, or control gaps, readiness and remediation help comes next. If you’re genuinely assessment-ready, a C3PAO assessment is the step.

Disclosure: The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification. This article is educational research, not legal, contractual, or compliance advice; confirm scope and applicability with a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney, and — if you’re considering a whistleblower action — with a qualified False Claims Act attorney. The contract clause and your CUI handling set your CMMC level, not a checklist. See our editorial standards and corrections policy.