SPRS self-attestation and False Claims Act risk
What four public DOJ cybersecurity settlements teach about accurate security representations. Amounts checked against the releases.
General educational guidance. Your contract and current official instructions control. No restricted information is accepted here.
An assessment should be supportable by the system and evidence it describes. Public DOJ settlements illustrate why cybersecurity representations deserve management attention. These are different cases involving different alleged conduct—not four findings that the same SPRS mistake occurred. A settlement amount is not a standard penalty or a prediction for another company.
Penn State: $1.25 million, announced October 22, 2024. DOJ described allegations involving contractual cybersecurity requirements, implementation representations, and cloud services. MORSECORP: $4.6 million, announced March 26, 2025. DOJ described failures involving cloud services, NIST requirements, system security planning, and an inaccurate SPRS score. Georgia Tech Research Corporation: $875,000, announced September 30, 2025, to resolve civil cyber-fraud litigation. Aerojet Rocketdyne: $9 million, announced July 8, 2022, to resolve allegations of misrepresented cybersecurity compliance. Read each linked release for its distinct facts.
The releases identify claims resolved as allegations, not determinations of liability; the MORSECORP release also describes factual admissions. Do not turn these summaries into an accusation about conduct beyond the published record.
Step-by-Step Process
Keep a traceable assessment record
Our practical recommendation: retain the assessed boundary, control evidence, assessment date, score calculation, responsible reviewer, and current SSP in your authorized records.
Reconcile before affirming
Compare statements in proposals, SPRS, provider agreements, and internal records. Escalate material discrepancies to qualified counsel and the responsible official.
Correct through the proper channel
Follow the applicable government system and contract procedures. Do not backdate implementation evidence or conceal a known gap.
Frequently Asked Questions
Is every security gap automatically fraud?
No. The cases are fact-specific. Do not equate every gap or inaccurate statement with legal liability; seek qualified advice about the actual facts and obligations.
Were all four settlements about SPRS scores?
No. The alleged conduct varies. MORSECORP’s release specifically discusses an inaccurate SPRS score; the other releases must be read on their own terms.
Does settlement mean liability was adjudicated?
The cited releases distinguish settlement of allegations from a determination of liability. MORSECORP’s release also includes factual admissions.
Official Sources
Sources and official documentation supporting this guide:
Need Expert Guidance?
Discuss your contracting and advisory needs with Haze Gray.