The False Claims Act is the enforcement mechanism that makes CMMC a legal obligation rather than a contractual preference. Every defense contractor operating under CMMC requirements should understand how the Act works, what triggers liability, and what a good-faith compliance program looks like as a legal defense.
This article explains the FCA in the CMMC context with specificity not general legal concepts, but the actual mechanics that apply to defense contractors managing cybersecurity compliance.
The False Claims Act defines "knowing" broadly under 31 U.S.C. § 3729(b): it includes actual knowledge of falsity, deliberate ignorance of the truth, and reckless disregard for the truth. A contractor does not need to intend to defraud the government. If an organization submits a SPRS score or CMMC affirmation while being recklessly indifferent to whether it is accurate, that meets the knowledge standard for FCA liability.
Good-faith compliance includes: conducting honest gap assessments, submitting accurate SPRS scores even when low, building and executing realistic POA&Ms, updating SPRS when material changes occur, ensuring affirmation signers are briefed on actual compliance status, and documenting all compliance decisions and their rationale. A documented history of genuine compliance effort is the strongest defense against qui tam claims.
Implied certification (the Aerojet theory) holds that submitting payment claims while knowingly non-compliant constitutes a false claim. The CMMC affirmation makes compliance representation explicit through a signed, dated attestation in SPRS. An explicit false affirmation is a stronger FCA case because the relator does not need to prove the compliance requirement was "implied" — the contractor directly attested to it.
The False Claims Act (31 U.S.C. §§ 3729-3733) is a federal civil statute that imposes liability on individuals and organizations that knowingly submit false or fraudulent claims for payment to the federal government, or knowingly make false statements material to false claims.
The statute was originally enacted during the Civil War to address contractor fraud in military procurement. It has been significantly strengthened through amendments in 1986, 2009, and 2010. Today it is the government's primary civil enforcement tool for contractor fraud, recovering over $2 billion per year across all sectors.
Key elements of FCA liability:
CMMC compliance representations enter the FCA framework through several mechanisms:
Every CMMC self-assessment submitted to SPRS is a representation to the government about the contractor's cybersecurity posture. When that representation is inaccurate — whether an inflated score, unclosed prohibited controls, or a stale affirmation — and the contractor continues receiving government payments under applicable contracts, the FCA applies under the implied certification theory.
The implied certification theory (confirmed by the Supreme Court in Universal Health Services, Inc. v. United States, 2016) holds that a contractor impliedly certifies compliance with material contractual requirements when it submits a claim for payment. A contractor that knows its CMMC posture does not match its SPRS submission impliedly falsely certifies compliance with each payment it receives.
Unlike the implied certification theory, which requires inference of a false representation, the affirmation requirement creates an explicit false statement when inaccurate. A senior official who affirms a CMMC status that does not reflect the organization's actual posture is making a knowing false statement in the government's compliance system.
This explicit representation is a materially stronger FCA case than an implied certification case. The affirmation is dated, signed (or electronically recorded), and retained in SPRS. It creates a documentary record of the false statement.
For contracts that require CMMC certification as an award condition, representations made in the solicitation response about CMMC status are direct false claims if inaccurate. A proposal that states "we hold CMMC Level 2 Final certification" when no such certification exists is a textbook false claim.
DFARS 252.204-7012 requires contractors to report cyber incidents within 72 hours of discovery. Failure to report a known incident while continuing to receive contract payments is a potential FCA violation if the incident reveals a compliance gap that the contractor is aware of.
The qui tam provision is the most distinctive feature of the FCA and the one with the most direct implications for how defense contractors manage their compliance programs.
Under 31 U.S.C. § 3730, a private individual with original source knowledge of a false claim can file a lawsuit on behalf of the federal government. The filing is made under seal, meaning the defendant does not know about the complaint while the government investigates. The government then decides whether to intervene (take over the case) or decline (allowing the relator to proceed independently).
Financial incentive: Relators receive 15-30% of the government's recovery. In the Aerojet Rocketdyne settlement ($9 million), the relator received between $1.35 million and $2.7 million. For larger organizations with higher contract values and longer periods of misrepresentation, the potential relator recovery is substantially higher.
Who files qui tam complaints: Former employees are the most common relators. Current employees, consultants, and competitors also file. The characteristics of a likely relator:
What relators look for: Direct knowledge of the gap between stated compliance and actual implementation. Internal communications showing the organization was aware of gaps. Evidence that the compliance representation was deliberately maintained despite known inaccuracies.
The Department of Justice Civil Division has established a formal CMMC enforcement initiative under its Cyber Fraud Initiative, launched in October 2021. The initiative specifically focuses on:
The initiative has resulted in multiple settlements and is actively encouraging qui tam filings from relators with CMMC-related knowledge. The infrastructure for enforcement is mature and operational.
The FCA's knowledge standard is broader than most contractors assume. Under 31 U.S.C. § 3729(b)(1), "knowingly" means:
The deliberate ignorance standard is the one that most often surprises contractors. A decision not to conduct a gap assessment — so that leadership cannot "know" about the gaps — does not provide legal protection. Courts have held that deliberately avoiding facts that would reveal falsity is itself FCA knowledge.
Similarly, a senior official who signs an affirmation without reviewing the basis for the compliance representation acts with reckless disregard if the representation is false. The defense that "I just signed what the security team told me to sign" may not survive scrutiny if the official had reason to be skeptical of the representation.
The Supreme Court's 2016 decision in Universal Health Services, Inc. v. United States refined the materiality standard for FCA cases. The Court established that:
For CMMC, the DoD has made the materiality question largely academic. The program was specifically designed to make cybersecurity compliance a verified condition of contract award and performance. The mandatory affirmation mechanism, the SPRS submission requirement, the formal assessment process, and the explicit regulatory framework all signal that cybersecurity compliance is material to DoD contracting.
When the government creates an elaborate verification mechanism for a requirement, the argument that the requirement is immaterial is extremely difficult to sustain.
The best FCA defense in the CMMC context is a genuine, documented, good-faith compliance program. Here is what that looks like:
Organizations that follow this approach have a documentary record showing they took compliance seriously, invested in understanding their posture, and remediated gaps systematically. This record is the strongest available defense if a qui tam complaint is filed.
Before any senior official signs a CMMC affirmation, confirm:
If any of these conditions are not met, address them before submission.
Concerned about your organization's FCA exposure? NR Labs builds CMMC compliance programs designed to produce an accurate, defensible compliance record. Contact us to discuss your situation.
