NIST 800-171 and the False Claims Act: what triggers it

How does a NIST 800-171 gap become a False Claims Act case?

A gap becomes a False Claims Act matter when a contractor knowingly submits a false claim, and in NIST SP 800-171 cases that often means relying on a system security plan or SPRS score that does not match the systems actually handling CUI. The Department of Justice has resolved several such matters: Raytheon, RTX and Nightwing agreed to pay $8.4 million in May 2025 over an internal development system without a system security plan, MORSECORP agreed to pay $4.6 million in March 2025 after admitting it lacked a consolidated system security plan until January 2021, and Georgia Tech Research Corporation agreed to pay $875,000 in September 2025 over a DoD cyber-defense lab that had no system security plan until at least February 2020. If your contract or subcontract requires NIST SP 800-171, the question is not only whether you have gaps but how far your written statements about those gaps can be defended.

Responsibility is split in a way that matters for this exposure. Your organization owns its controls and the certifications and score statements it signs. An implementation partner can prepare systems, documentation and evidence, but it does not decide what your company certifies. Only an independent assessor or auditor issues reports, and a government assessment produces results that you do not control. Before you sign anything, confirm in writing who prepared each artifact, who verified it, and who is accountable for the statement it supports.

The size of the answer depends on three things: which systems actually hold or process CUI, whether the posted score reflects those systems as they exist today, and who signs the statements tied to the contract. A score posted for an environment that has since changed, or a plan that describes a boundary your staff does not operate, can create liability even when no breach has occurred. Start by listing every system in scope, comparing each one against its current system security plan and SPRS entry, and recording who approved each figure. Those records are what will show, if questioned, that the organization acted in good faith.

Which gaps sat behind the settlements?

Three recent settlements turned on a small set of gaps that an assessor or whistleblower could check quickly: a missing system security plan, controls not fully in place, a cloud or email service outside the required security baseline, and absent anti-malware tools. The cards below describe each gap and the check to run in your own environment. They are not a complete list of what matters under NIST SP 800-171.

Missing or incomplete system security plan

Raytheon's settlement concerned an internal development system used for unclassified DoD work without a system security plan, and Georgia Tech's cyber-defense lab had no plan until at least February 2020. MORSECORP did not have a consolidated plan until January 2021. A plan that describes systems on paper but not the systems actually in use is the gap to look for. Check that every system that stores, processes or transmits CUI is named in the plan, with its boundary, owners and current controls, and that a person outside the project team could find it and confirm it matches the environment.

Controls not fully implemented

MORSECORP admitted that it had not implemented all NIST SP 800-171 controls. A plan that lists requirements as met, while some are still open, is the pattern that turns a self-assessment into a false statement. For each requirement you claim, ask for evidence that the control operates today, such as a configuration export, an access review record or a log sample, and record any gap as an open item rather than as a met requirement. Consider whether any score you post reflects this same status.

Email host without FedRAMP Moderate equivalence

MORSECORP used a third-party email host from January 2018 without ensuring FedRAMP Moderate equivalent security for that service. Email often carries CUI in attachments and replies, so a hosted mail service can fall inside the protection scope even when no one thinks of it as a system. Check which mail, file sharing and collaboration services receive CUI, confirm in writing whether each provider meets the equivalent security expected under DFARS 252.204-7012, and document the decision for each one.

Missing anti-malware tools

Georgia Tech's lab, which did DoD cyber-defense research, lacked anti-malware tools until December 2021. The gap was not subtle: a research environment without endpoint protection is easy to verify and hard to explain to an assessor. Inventory every endpoint and server in the CUI boundary, confirm that malicious code protection is deployed and updated on each one, and keep the deployment records that show when coverage began and who approved any exception.

How a whistleblower case moves from filing to settlement

The qui tam sequence turns a private complaint about a gap in NIST SP 800-171 controls into a government-backed case, and every stage leaves a record that a contractor's own documentation will be measured against.

Insider raises concerns about the system
A current or former employee, often someone on the security or IT team, sees a gap such as a missing system security plan, a tool that was never deployed or an inaccurate score being submitted. In the Georgia Tech case, two former members of the cybersecurity team later filed the complaint. The check that closes this step is internal: the person has documented what they saw and when, and the organization's own records either confirm or contradict it. Ask counsel how any internal reporting duty applies before anyone outside the company is contacted.
Relator files a sealed qui tam complaint
The whistleblower, called the relator, files a complaint under the False Claims Act's qui tam provisions on behalf of the government. The complaint is generally filed under seal while the government decides whether to take over the case. The relator's attorney prepares the filing, and the output is a court record that the organization may not see for some time. Organizations should not assume that quiet means no case exists.
Government investigates and decides whether to intervene
The Department of Justice reviews the allegations, which often includes document requests and interviews with current and former staff. In the Georgia Tech matter the United States intervened in August 2024, and in the Raytheon and MORSECORP matters the government pursued the claims through settlement. The check at this stage is whether the government takes over the lead on the claims, which changes how the case is litigated and settled. Ask counsel what preservation and cooperation obligations apply once an investigation is known.
Parties negotiate and settle the allegations
The company, the government and sometimes the relator negotiate a resolution covering the period of alleged non-compliance. The settlement terms typically include a payment and admissions or commitments about the controls in question. The Georgia Tech case settled for $875,000 in September 2025, and MORSECORP agreed to $4.6 million in March 2025 with admissions about a missing consolidated system security plan and incomplete NIST SP 800-171 controls. The output is a signed agreement and a public Department of Justice announcement.
Relator receives a share of the recovery
Under the qui tam provisions, the relator receives a portion of the government's recovery. The Raytheon whistleblower received $1,512,000 from the $8.4 million resolution in May 2025. The MORSECORP whistleblower received $851,000 of the $4.6 million settlement, and the Georgia Tech relators received $201,250. The payment is the final record of the case, and it shows why internal concerns about SSPs and scores tend to end up in front of regulators. Counsel should explain how these incentives apply to any disclosure decision.
Organization updates its controls and records
After settlement, the organization is expected to show that the cited gaps were closed and that its records are accurate going forward. Typical evidence includes a current system security plan covering the relevant systems, deployed tooling with logs, and a score posted in SPRS that matches the environment being assessed. The check is whether an independent review of these records would reproduce the same conclusions as the original submissions. An implementation partner can prepare the systems and evidence, but the organization owns its controls and any reporting to the government.

Who carries the exposure: prime, acquirer, university or subcontractor?

A prime contractor that holds a DoD contract carries the most direct exposure. In the Raytheon matter, the government alleged that Raytheon failed to develop and implement a system security plan for an internal development system used for unclassified DoD work, and that it failed to meet other requirements of DFARS 252.204-7012 and FAR 52.204-21 between 2015 and 2021. Raytheon, RTX and Nightwing agreed to pay $8.4 million to resolve the allegations, and the whistleblower received $1,512,000. The DOJ announcement describes the conduct in more detail.

The system security plan: A missing or incomplete SSP for a system that handles covered information was the core of the allegation.
Two clauses, two duties: DFARS 252.204-7012 and FAR 52.204-21 both carried safeguarding obligations, so map each one to the systems that actually perform the work.
Years, not a single lapse: The alleged period covered six years, so a gap that persists over time creates a longer record of exposure.
Internal systems count: The system at issue was an internal development environment, so the boundary extends beyond production networks.

Confirm that every system used for DoD work has a current SSP, and that any score or statement you submitted matches what those systems do today.

What DoD said about False Claims Act risk in the CMMC rule

The CMMC final rule, published 15 October 2024, answers commenters who worried about False Claims Act exposure by stating that DoD lacks authority to change the False Claims Act, the federal law that imposes liability on anyone who knowingly submits a false claim to the Government. The rule also states that requests for a safe harbor were outside its scope. For a contractor, the practical meaning is that the statute applies on its own terms. A DoD program requirement does not shield a company from a qui tam suit, and a clean self-assessment does not prove that the claims made under a contract were accurate. The exposure in the settled cases came from certifications of compliance that did not match what the company had actually built, not from a failure to satisfy a CMMC checklist.

Treat the rule's silence on safe harbor as a planning fact. Before any invoice or certification relies on NIST SP 800-171 status, the compliance lead should confirm that the system security plan, the SPRS posting and the statements in the contract match the environment as it exists today. Where a gap is known, the organization should record it in a plan of action and milestones and avoid representing the control as in place. Written records of who reviewed a score and when are the evidence a counsel will ask for first.

Which revision applies is a contract question, not a program question. The current DFARS 252.204-7012 clause and the DoW class deviation that names SP 800-171 Revision 2 determine the standard in force for many DoD awards, while the proposed FAR overhaul would move civilian and government-wide CUI contracts toward Revision 3. Counsel should confirm the revision named in each contract, its date and any class deviation attached to it, and the organization should not assume that a later revision replaces the one in the signed agreement. A mismatch between the revision assessed and the revision in the contract is itself a point an assessor or relator can raise.

What to verify before anyone signs a compliance statement or posts a score

Most False Claims Act cases in this area turned on paperwork that did not match the systems in use. The checks below give the compliance lead a way to confirm that the plan, the score, the hosts, the controls and the signer all describe the same environment before anyone certifies it. Record the result of each check and keep the evidence with the assessment file.

System security plan coverage

Confirm that the system security plan names every system that processes, stores or transmits CUI, including laptops, build servers, collaboration tools and backup locations. Check that the plan reflects the current architecture and that its revision date follows the last significant change. The MORSECORP settlement involved a company that lacked a consolidated plan until January 2021, and the Georgia Tech case alleged no plan existed for a research lab. Walk the boundary with a diagram and an asset list, then sign off only if every item on the list appears in the plan.

Score matches the environment today

Compare each SPRS score against the systems that exist now, not the systems that existed when the assessment ran. Scores that cover a decommissioned enclave or omit a newly added environment describe a boundary no one operates. Ask whether any system was retired, merged or moved to a cloud account since the assessment, and confirm whether the posted score for that environment still belongs in SPRS. Record the comparison in the assessment file with the date you ran it.

Third-party hosts and email services

Confirm that every external host that stores or transmits CUI, including email providers, file-sharing services and managed cloud platforms, meets the security expectations written into the contract and the plan. The MORSECORP case centered on a third-party email host used without assurance of FedRAMP Moderate equivalent security. Request the provider's authorization documentation, confirm the data location and encryption terms, and check that the plan names each provider and the controls the provider covers. Where the provider cannot supply evidence, treat that system as in scope.

Controls claimed in the plan operate

Sample each control the plan describes as implemented, such as anti-malware protection, patch deployment, multifactor authentication and audit log review. Pull the configuration, the most recent scan or deployment record and the alert history for the sample. A control written into the plan but disabled on a subset of endpoints is the kind of gap the Georgia Tech case described, where anti-malware tools were absent until December 2021. Log each sample, the date it was pulled and the person who reviewed it.

Three-year currency of the assessment

Under DFARS 252.204-7019, an assessment used for award must be current, meaning not more than three years old unless the solicitation sets a shorter period. Confirm the completion date of the assessment behind each posted score and calculate its expiry against the solicitation terms. Note any upcoming contract action that will fall after that date. A score that has passed its currency window should not support a new offer, even if the number itself is accurate.

Who has authority to sign

Identify, in writing, the individual who may sign the affirmation, the SPRS posting and any certification to the government, and confirm that person has reviewed the evidence behind it. The False Claims Act reaches statements made knowingly, so the signer should understand what the statement asserts before signing. Confirm that the signer is not relying solely on a consultant's summary, and that the authority list is updated when personnel change. Keep the signed delegation with the assessment record.

Which kind of outside help fits each question

This table matches each question raised by a NIST SP 800-171 gap to the outside party who can answer it and the limit on what that party may do. Read each row as a division of roles: the organization owns its controls and its score, and only the Government or an independent party issues results. The main takeaway is that no outside firm should sign off on a score or a DoD result it did not issue.

Question	Who answers it	What they must not do
Did a gap or inaccurate score create legal exposure, and what must be disclosed?	Outside counsel with False Claims Act experience, who directs the review and manages privilege	Do not let technical consultants run the review outside counsel directs, or share findings without counsel's direction
Is the posted SPRS score and system security plan accurate?	Independent third-party assessor or consultant, who tests the score against the evidence	Do not issue a DoD or DCMA assessment result or present their review as one
Are the system security plan, policies and evidence ready for assessment?	Implementation partner such as DeployOpen, who prepares systems, plans and evidence	Do not certify compliance, attest to a score or sign the organization's SPRS posting
Are controls actually working on the systems in scope?	Implementation partner and the organization's own security staff, with testing by an independent tester if needed	Do not write findings into a plan of action and milestones on the organization's behalf without its approval
Did a Government assessment find deficiencies, and what happens next?	DCMA DIBCAC, which issues the assessment result	Do not write the rebuttal or results for the Government, and do not treat a consultant's view as a Government result
Did a target company inherit past SPRS or FCA exposure?	Outside counsel for diligence, with an independent assessor reviewing the score and plan	Do not assume a seller's score is accurate without evidence, and do not sign off on the acquired score themselves

What outside help can and cannot change in your exposure

An implementation partner can close gaps, but it cannot rewrite what was already submitted. Outside help can rebuild a system security plan, map the current environment to the requirements, configure the controls that are missing, and assemble the evidence an assessor will ask for. Done before a score is posted, that work makes the next statement more defensible. It cannot make a past SPRS posting, a past certification of compliance, or a past claim that a system was covered accurate after the fact. The MORSECORP and Georgia Tech settlements turned on the gap between what was represented and what existed at the time, so the historical record is the part no consultant can change. A partner also cannot issue a DoD assessment result. Only the Government, through DCMA DIBCAC, produces that outcome, and no contractor or consultant can guarantee its result. Nor can a partner guarantee that a current or former employee will not file a qui tam suit under the False Claims Act.

The controls the organization can actually change are narrower and more concrete. It can correct the system security plan so it describes the systems that really exist, recalculate its score using the DoD Assessment Methodology with an honest accounting of what is and is not implemented, and keep that posting current. It can document each corrective step with dates, owners and evidence so that the record shows what was known and when it was fixed. It can also decide who in the organization is responsible for reviewing claims made to the Government, including whether a score or certification needs correcting. Those are the decisions that determine exposure from here on, and they belong to the organization and its counsel. Any choice about whether to disclose a past inaccuracy, and how, is a legal decision that a partner should support but not make.

Before engaging outside help, ask the partner in writing which of these tasks it will perform, which deliverables it will hand over, and which decisions it will leave with your own leadership and counsel. A written scope that says the partner prepares systems and evidence, and that an independent assessor or the Government issues any result, is the accurate starting point. Be cautious about any proposal that promises a particular score, a clean assessment or protection from enforcement.

Questions buyers ask about False Claims Act risk and NIST 800-171

Does every NIST 800-171 gap lead to a False Claims Act case?

No. A gap in implementation does not by itself create False Claims Act liability. The Act reaches people who knowingly submit false claims to the Government, so liability turns on what the organization knew, what it represented in its contract paperwork and scores, and whether those statements were accurate when made. The settled cases in this area share a pattern: a missing or outdated system security plan, controls that were not implemented, and representations that did not match the environment. Gaps are a source of risk, and the most useful response is to document them, track them in plans of action and milestones, and state them accurately. Confirm the specific exposure with counsel who understands federal contracting.

Can a self-assessed NIST 800-171 score create False Claims Act exposure?

Yes, if the score is inaccurate. A self-assessed score posted in SPRS is a representation to the Government, so a score that credits controls that are not in place, or that describes a system that does not exist, can be the basis of an allegation. This is why the score must match the environment it describes, including the boundary, the systems in scope and the status of each requirement. Review the score whenever the environment changes, when a Government assessment produces a different result, and before an annual affirmation. Ask any reviewer to show how each credited requirement is supported by evidence in the system security plan.

How long does an outside NIST 800-171 review take, and what does it cost?

Scope drives both the duration and the cost. The main inputs are the number of systems and users in the CUI boundary, how much of the environment is already documented, how many requirements need technical work, and whether the review is a readiness check or a pre-assessment against the full set of requirements. A fixed-scope engagement starts from a written scope listing systems, deliverables and timelines, and the quote follows from that scope. Ask any provider to state the systems covered, the requirements tested, the evidence delivered and the points where the organization must provide input. Costs for an independent assessment are set by the assessor, so ask for that quote separately.

What does the organization need to provide for this work?

The work needs decisions and access from the organization, and the partner cannot supply them. Expect to name an accountable owner for the CUI environment, a technical lead for each system in the boundary, and a contact for contracts and legal questions. Systems, configuration exports, identity and logging records, and administrator time must be available for the duration of the work. Documented decisions matter as much as technical changes: scoping choices, risk acceptances, and how the organization will handle requirements it does not meet all need written sign-off. Involve counsel early when the work touches past score submissions or disclosure questions, since those decisions carry legal consequences that technical teams should not decide alone.

Can our own team prepare for a NIST 800-171 assessment without outside help?

Yes, if the team has the skills, the time and the authority to change systems and records. An internal team can build the system security plan, map each requirement to evidence, correct gaps and maintain the score. Independent checking still adds credibility, because an internal team may miss gaps in systems it runs every day and may be reluctant to lower a score it previously posted. An outside review can test the score against the environment before a Government assessment or a contract award does. Decide which parts you will own, which you will verify externally, and who signs off on the final score.

Can a partner issue a NIST 800-171 certificate or report?

No. DeployOpen prepares systems, controls and evidence for an assessment, but it does not issue reports, attestations or certificates. NIST 800-171 results come from the Government: DoD assessments under its methodology, and DCMA DIBCAC assessments where they apply. Independent assessors that the organization engages may produce their own findings, but those are not a Government score. The organization is responsible for the score it posts in SPRS and for the statements it makes to the Government. Ask any provider which parts of the work it performs and which results it can and cannot issue.

Does acquiring a business mean inheriting its False Claims Act liability?

It can. Liability for conduct before an acquisition may remain with the business that acquired the contract, and the Raytheon settlement is a relevant example. The settlement covered conduct that allegedly occurred between 2015 and 2021, before Nightwing acquired the business from RTX in March 2024, and Nightwing was among the settling parties. Acquirers should review the target's system security plan, SPRS postings and contract representations during due diligence, and should plan how to correct inaccurate scores after closing. Confirm the transaction-specific position with counsel.

How DeployOpen prepares systems and evidence before a NIST 800-171 review

DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, so the system security plan, configurations and logs match what an assessor will test. We prepare systems and evidence; only an independent assessor or the Government issues results, and the organization owns its controls and the accuracy of any score it posts.

How we scope

Scope starts with the systems that store, process or transmit CUI, and the boundary around them.
Each engagement is fixed-scope, with deliverables and timelines agreed in writing before work starts.
The written scope states which requirements, ODP values and assessment objectives are covered, and which remain with your team.

How we build

We configure self-hosted platforms against the Rev. 3 requirements, including encryption, logging, access and boundary controls.
We security test applications, APIs and infrastructure so gaps are found before an assessor finds them.
We help define the organization-defined parameter values your contracting agency expects, and record each one.

How we hand over

We deliver a system security plan draft, configuration baselines and a requirement-by-requirement evidence map for your review.
Evidence is organized so you can show an assessor how each requirement is implemented and who is accountable for it.
Your team receives documented procedures and runbooks, so the controls keep working after the engagement ends.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can keep the system security plan, plans of action and evidence current as systems change.
Before any SPRS posting or Government assessment, confirm with your own counsel and assessor what must be verified.

NIST 800-171 and the False Claims Act