Whistleblowers, False Claims, and CUI Protection: What Defense Contractors Need to Know

What the CMMC Phase II Suspension Does—and Does Not—Change

On July 13, 2026, the Department of War suspended the planned November 10, 2026 transition to CMMC Phase II and began a broader review of the program.

The announcement changed the planned expansion of CMMC third-party and government-led assessment requirements. It did not end the CMMC program, eliminate existing contractual cybersecurity obligations, or remove the Phase I self-assessment requirements already in effect.

The Department has been explicit: all Phase I self-assessment requirements remain firmly in place (U.S. Department of War).

During the suspension, applicable procurement requirements remain focused on CMMC Level 1 Self and Level 2 Self assessments. When a solicitation or contract requires one of those levels, an organization may need to:

• Conduct the applicable CMMC self-assessment
• Enter the required assessment result in the Supplier Performance Risk System, or SPRS
• Submit and maintain the required affirmation of continuous compliance
• Maintain documentation and objective evidence supporting its assessment
• Continue meeting the applicable requirements throughout contract performance

A current CMMC status and affirmation may also be a condition of award when the applicable clauses are included in a solicitation (Acquisition.gov).

The underlying responsibility to protect CUI also remains.

Organizations subject to DFARS 252.204-7012 must continue providing adequate security for covered contractor information systems that process, store, or transmit covered defense information. This includes implementing the applicable NIST SP 800-171 requirements and meeting the clause’s cyber-incident reporting and related obligations.

The practical message for DIB companies is straightforward:

The planned expansion of third-party assessments was suspended. The responsibility to protect CUI and support applicable self-assessments and affirmations was not.

Is There a CMMC Whistleblower Program?

There is no separate federal program formally called the “CMMC Whistleblower Program.”

What people often describe as CMMC whistleblower activity generally involves the federal False Claims Act, or FCA.

The False Claims Act allows private parties—commonly called relators or whistleblowers—to bring lawsuits on behalf of the United States when they believe an organization or individual has knowingly submitted false claims or used false statements that were material to government payment or eligibility.

These cases are called qui tam actions. They are initially filed under seal while the government investigates and decides whether to intervene (Department of Justice).

In 2021, the Department of Justice established its Civil Cyber-Fraud Initiative, which uses the False Claims Act to pursue cybersecurity-related fraud involving government contractors and grant recipients.

The initiative focuses on allegations that an organization knowingly:

• Provided deficient cybersecurity products or services
• Misrepresented its cybersecurity practices or protocols
• Violated obligations to monitor and report cybersecurity incidents or breaches

The initiative did not create a separate CMMC enforcement statute. It applies the existing False Claims Act to cybersecurity representations and contractual obligations (Department of Justice).

That distinction is important because not every cybersecurity deficiency is a false claim.

A Security Gap Is Not Automatically Fraud

Most DIB companies will discover cybersecurity gaps at some point.

An organization may find that:

• A control is only partially implemented
• A policy is out of date
• An employee used an unapproved workflow
• A system was unintentionally left within the CUI boundary
• Evidence is incomplete
• A previous assessment contained an error
• A cloud service does not meet an applicable requirement
• A technical safeguard is not operating as consistently as expected

Finding a problem does not automatically mean an organization committed fraud.

The False Claims Act generally focuses on whether an organization knowingly made or caused a false claim. Its knowledge standard can include actual knowledge, deliberate ignorance, or reckless disregard for whether the information was true. An innocent mistake or ordinary disagreement over implementation is not the same as knowingly maintaining an unsupported representation.

The Department of Justice explains that FCA liability can involve three times the government’s damages, plus an inflation-adjusted civil penalty for each false claim (Department of Justice).

The more useful question for DIB leaders is therefore not:

“Do we have any cybersecurity gaps?”

It is:

“Do we understand our gaps, have we represented them accurately, and are we responding responsibly?”

An organization that identifies a deficiency, documents it, evaluates its effect, corrects inaccurate information, and establishes a realistic remediation plan is in a very different position from one that conceals the deficiency or continues making claims it knows it cannot support.

What a Cybersecurity False Claim Could Look Like

False Claims Act cases are highly fact-specific. An inaccurate statement does not automatically establish liability, and published settlements generally resolve allegations without a determination at trial.

Still, recent cases provide useful examples of the kinds of disconnects that create concern.

An unsupported assessment score

Suppose a contractor submits a high assessment score to SPRS.

Internally, however:

• Multiple applicable requirements are not implemented
• The score was based on policies rather than actual configurations
• Systems handling CUI were excluded without a sound basis
• A consultant’s findings contradict the submitted result
• Leadership is aware that the score cannot be supported

A calculation error can be corrected. The greater risk arises when the company learns that its submitted score is materially inaccurate and continues relying on it without taking appropriate action.

Controls that exist on paper but not in practice

A company may have policies stating that multifactor authentication, encryption, access reviews, audit logging, or incident-response procedures are in place.

But a policy alone does not prove implementation.

A representation may become difficult to support when:

• The control applies to only part of the CUI environment
• Users routinely bypass the process
• Required systems were never configured
• The control is not monitored or tested
• The company cannot produce evidence that it operates as described

The self-assessment should reflect the real environment—not simply what the policy says should happen.

CUI moving outside the documented boundary

A company may describe a controlled CUI environment while employees are actually:

• Downloading CUI to local computers
• Sending technical drawings through ordinary email
• Saving files to standard shared drives
• Using unapproved collaboration platforms
• Accessing CUI from unmanaged devices
• Sharing information with subcontractors outside the defined environment

These situations are not necessarily the result of bad intent. They often arise because the actual CUI workflow was never fully mapped.

Once the organization becomes aware of the mismatch, however, it should evaluate the issue and ensure that future assessments and affirmations accurately reflect the environment.

Inadequate treatment of known deficiencies

A gap analysis, internal review, consultant assessment, security incident, or employee report may identify weaknesses.

Risk can increase if an organization then:

• Ignores the findings
• Suppresses an unfavorable assessment
• Removes issues from documentation without remediation
• Claims that corrective action was completed without validation
• Continues submitting unsupported representations
• Pressures employees to approve conclusions they believe are inaccurate

A negative assessment result is not a failure of the assessment process. It is useful information that allows the organization to prioritize action.

Why Self-Assessments Matter

A self-assessment is not merely an administrative step or a score-generation exercise.

It is how an organization determines whether the applicable requirements are implemented within a clearly defined assessment scope.

A defensible self-assessment should answer several basic questions:

• What environment was assessed?
• Where is CUI stored, processed, and transmitted?
• Which users, endpoints, applications, and external providers are included?
• How is each applicable requirement implemented?
• Who is responsible for operating the control?
• What objective evidence supports the conclusion?
• What gaps remain?
• Have any material changes occurred since the last assessment?

For each requirement, the organization should be able to connect its conclusion to evidence.

Depending on the requirement, that evidence may include:

• System configurations
• Access-control records
• Logs
• Policies and procedures
• Network and data-flow diagrams
• Screenshots
• Security tickets
• Training records
• Asset inventories
• Incident-response records
• Technical test results
• Contracts or responsibility matrices with service providers

This does not mean every artifact must be perfect or that every company needs an enormous evidence repository.

It means the organization should have a reasonable, repeatable basis for the answer it submits.

Internal readiness reviews and formal self-assessments serve related purposes

It can be helpful to distinguish between two activities.

1. An internal readiness review helps an organization understand its current state, identify gaps, evaluate evidence, and prepare for an accurate submission.
2. An applicable CMMC self-assessment is the formal assessment required when a solicitation or contract calls for CMMC Level 1 Self or Level 2 Self.

An organization does not generally submit every internal worksheet or readiness finding to the government. But the internal review creates the factual foundation for the formal result and helps the organization avoid relying on assumptions.

The goal should not be to create the highest possible score. The goal should be to establish the most accurate supportable result.

Self-Attestation Requires More Than Confidence

The phrase “self-attestation” is often used broadly, but the CMMC contractual requirement is more specifically an affirmation of continuous compliance by an affirming official.

Under DFARS 252.204-7021, contractors with an applicable CMMC requirement must complete and maintain the required affirmation in SPRS. The clause also requires appropriate affirmations from subcontractors and suppliers when CMMC requirements are flowed down (Acquisition.gov).

A Final CMMC Level 1 Self status is generally current for one year, while a Final Level 2 Self assessment is generally current for three years. The associated affirmation of continuous compliance must remain current and is generally required annually (Acquisition.gov).

That makes self-attestation more than a statement that leadership feels comfortable with the company’s cybersecurity posture.

The affirming official should have a reasonable basis for understanding:

• Which systems and workflows were assessed
• How the applicable requirements are implemented
• What evidence supports the result
• What responsibilities are inherited from or shared with providers
• What responsibilities remain with the company
• Whether known gaps affect the ability to affirm compliance
• Whether material changes have occurred since the assessment

A documented self-assessment and organized body of evidence help provide that basis. Self-assessment does not mean guessing. It means the organization is taking responsibility for evaluating its own environment accurately and standing behind the result.

Why Whistleblowers Matter

A cybersecurity whistleblower may be a current or former:

• IT administrator
• Cybersecurity professional
• Compliance manager
• Engineer
• Program manager
• Executive
• Consultant
• Managed service provider employee
• Subcontractor
• Business partner

These individuals may have access to information that is difficult for an outside customer or investigator to see, including:

• Internal assessment reports
• Emails discussing known deficiencies
• Unsupported score calculations
• Security tickets closed without remediation
• Evidence that CUI exists outside the documented environment
• Instructions to change or suppress an assessment result
• Differences between policy language and actual system configurations

The False Claims Act provides financial incentives for whistleblowers whose cases produce a government recovery. Depending on whether the government intervenes and other circumstances, a relator may generally receive a percentage of the recovery.

That incentive is real. But the right organizational response is not to view employees as threats.

A healthier response is to create internal processes where concerns can be raised, evaluated, documented, and addressed without retaliation.

An employee who says, “I do not think this assessment answer is supportable,” may be identifying an opportunity to correct the record before the issue becomes more serious.

What Recent Cases Can Teach the DIB

The following cases involved allegations and settlements. Unless otherwise stated, settlements resolve disputed claims and do not necessarily constitute admissions of liability.

Their value is not in encouraging companies to expect the worst. Their value is in showing where documentation, actual implementation, and external representations can drift apart.

MORSECORP: Reconciling assessment findings with external representations

MORSECORP agreed to pay $4.6 million to resolve allegations involving cybersecurity requirements in Army and Air Force contracts.

According to the settlement agreement, a third-party cybersecurity consultant informed MORSECORP in 2022 that its NIST SP 800-171 summary-level score was negative 142. The consultant reported that approximately 22% of the requirements were implemented and 78% were not implemented or were only partially implemented. The government alleged that the company later made inaccurate representations about its cybersecurity posture (Department of Justice).

The practical lesson: Conducting a gap analysis is responsible. When the findings are unfavorable, they should be reconciled with any score or representation the company makes. The assessment should become the foundation for corrective action—not a document to set aside.

Swiss Automation: CUI protection applies beyond large prime contractors

Swiss Automation, an Illinois precision machining company, agreed to pay $421,234 to resolve allegations involving cybersecurity protections for technical drawings related to parts supplied to DoD prime contractors.

The settlement materials describe allegations that the company knowingly failed to provide adequate cybersecurity required by DFARS 252.204-7012 for certain drawings associated with purchase orders (Department of Justice).

The practical lesson: CUI protection is not only an issue for large defense technology companies. Machine shops, component manufacturers, engineering firms, and other lower-tier suppliers may receive sensitive drawings or specifications as part of ordinary contract performance.

The smaller the internal cybersecurity team, the more valuable a clearly defined and manageable CUI environment may become.

Penn State: Documentation, remediation, and cloud-service requirements

Penn State agreed to pay $1.25 million to resolve allegations involving cybersecurity requirements in 15 DoD or NASA contracts and subcontracts.

The government alleged that Penn State did not implement certain NIST SP 800-171 requirements and did not adequately document, develop, and implement plans of action designed to correct identified deficiencies. The matter also included allegations involving an external cloud service and applicable security requirements (Department of Justice).

The practical lesson: The assessment result, technical environment, documentation, and remediation program should remain aligned.

A POA&M should not be treated as a static list. Where permitted and appropriate, it should identify a real deficiency, assign responsibility, establish milestones, track progress, and preserve evidence of closure.

Raytheon and Nightwing: Cybersecurity obligations can be connected to performance and payment

Raytheon and Nightwing agreed to pay $8.4 million to resolve allegations that certain contract work was performed without meeting applicable cybersecurity requirements.

The government alleged that failures to implement required security measures caused claims for payment under the contracts to be false. The settlement resolved allegations and was not a determination of liability at trial (Department of Justice).

The practical lesson: Cybersecurity compliance should not sit only within the IT department.

Contract management, legal, program leadership, cybersecurity, finance, and executive stakeholders should share an understanding of:

• Which clauses apply
• Which systems support contract performance
• What representations have been made
• Whether the evidence continues to support them

LOGZONE: A submitted score must be supportable

In June 2026, LOGZONE agreed to pay $507,144 to resolve False Claims Act liability relating to alleged cybersecurity violations in Navy contracts.

The government alleged that the defense contractor knowingly failed to comply with cybersecurity requirements associated with its contract performance (Department of Justice).

The practical lesson: An SPRS result is not merely an entry in a government system. The organization should retain the scope, methodology, evidence, assumptions, and approvals that support the result.

Why Well-Intentioned Companies Can Still Submit Inaccurate Information

Most DIB organizations are not trying to mislead the government.

They are often trying to answer complex questions with incomplete information and limited resources. Several common operational conditions can create risk.

One person owns everything

An IT manager may be expected to manage the network, interpret DFARS clauses, calculate an assessment score, prepare policies, answer customer questionnaires, and gather evidence.

That concentration of responsibility makes independent validation difficult.

The policy and the technology have drifted apart

The policy describes the intended process, but systems, applications, and employee behavior have changed.

The documentation may still describe a control that is no longer implemented as written.

The CUI boundary is unclear

The organization may not know exactly where CUI enters, where copies are created, how employees access it, or which subcontractors receive it.

Without a clear boundary, a complete and accurate self-assessment becomes much harder.

Sales or contract deadlines drive the answer

A customer questionnaire or solicitation response may be due quickly. Employees may feel pressure to give a positive answer before technical and operational stakeholders have validated it.

Documentation is created only for an assessment

Policies, diagrams, and screenshots assembled immediately before a submission may not reflect ongoing business practices.

The company assumes a vendor provides compliance

A cloud provider, managed service provider, consultant, or security platform can contribute important capabilities.

But no provider can assume every customer responsibility.

The contractor still needs to understand:

• What information it handles
• Which requirements apply
• What systems and users are in scope
• Which controls are inherited or shared
• Which controls remain the customer’s responsibility
• Whether employees follow the documented processes
• Whether the overall assessment and affirmation are accurate

A Practical Approach to Reducing False Claims Risk

The objective is not to create more paperwork. It is to build a repeatable process that produces reliable answers.

1. Map how CUI actually moves

Identify:

• How CUI enters the organization
• Where it is stored
• Which applications process it
• Which users need access
• Whether files are downloaded locally
• How it is transmitted internally and externally
• Which suppliers and subcontractors receive it
• Where copies may remain after the work is complete

Map actual behavior, not just the intended process.

2. Establish a clear CUI boundary

A broad CUI footprint may bring more systems, users, endpoints, applications, and locations into scope.

A defined environment can make responsibilities easier to understand, controls easier to manage, and evidence easier to collect.

3. Conduct an evidence-based self-assessment

For each applicable requirement, document:

• The implementation approach
• Control ownership
• Systems covered
• Supporting evidence
• Testing or validation performed
• Known limitations
• Any permitted remediation activity

Do not assume that a written policy proves that a requirement is implemented.

4. Preserve the assessment record

Maintain a defensible record of:

• The assessment date
• The environment and scope
• The methodology used
• Evidence reviewed
• Stakeholders involved
• Assumptions made
• Gaps identified
• Resulting score or status
• Changes since the prior assessment

This record helps the organization explain how it reached its conclusion and supports future reassessments.

5. Treat documentation as a reflection of reality

The System Security Plan, policies, procedures, network diagrams, data-flow descriptions, asset inventories, and assessment results should describe the environment as it operates today.

Documentation should change when the environment changes.

6. Build a body of objective evidence

Do not wait for a customer inquiry or assessment deadline.

Collect and maintain evidence as part of normal operations. Evidence should show not only that a control was designed, but that it is being operated as described.

7. Create a review process for external representations

Before submitting a self-assessment result, SPRS entry, affirmation, proposal response, or customer questionnaire, involve the appropriate stakeholders.

Depending on the organization and the representation, that may include:

• IT or cybersecurity
• Contract management
• Program leadership
• Legal counsel
• Executive ownership
• The affirming official

The purpose is not to create unnecessary bureaucracy. It is to avoid placing a high-consequence representation on one employee who may not have visibility into the complete environment.

8. Encourage internal reporting

Give employees a clear way to raise concerns.

When someone identifies a potential inconsistency:

• Take the concern seriously
• Preserve relevant information
• Evaluate it objectively
• Avoid retaliation
• Correct inaccurate information when necessary
• Document the organization’s response

Internal reporting is a valuable control—not a threat to the organization.

9. Reassess after material changes

A prior assessment or affirmation may no longer be supportable following:

• A cloud migration
• A new application
• An acquisition
• A facility change
• A change in managed service provider
• A new subcontractor workflow
• A security incident
• A major architecture change
• The introduction of CUI into a previously out-of-scope system

Ongoing compliance requires the organization to keep its environment, documentation, evidence, and representations aligned.

How Exostar Can Help You Protect CUI and Make Compliance Defensible

At Exostar, we believe the most productive question is not, “how do we avoid a whistleblower?” Nor is it, “how quickly can we prepare for a third-party assessment?” The more useful question is, “how do we protect CUI today and support our self-assessment, SPRS submission, and affirmation with accurate documentation and objective evidence?”

For many DIB organizations, the greatest source of difficulty is the complexity of the CUI environment.

CUI may be spread across:

• Employee laptops
• Commercial email
• Shared drives
• Engineering systems
• Collaboration platforms
• Local file storage
• Multiple cloud environments
• Prime and subcontractor workflows

Every additional location can add users, endpoints, controls, documentation, and evidence that the organization must manage.

Exostar helps companies take a more controlled approach.

Secure where CUI is stored, processed, and transmitted

Exostar’s managed environment gives approved users a controlled place to access, work with, store, and share CUI.

Users log in, launch a managed virtual desktop, and work with CUI inside the defined environment. The objective is to reduce reliance on local downloads, ordinary email attachments, uncontrolled shared drives, unmanaged devices, and unapproved sharing.

Exostar’s enclave model is built around the full CUI journey: users enter through a controlled access point, work through a managed virtual desktop, and store, process, and share CUI within the secure environment.

Reduce the compliance footprint

Some organizations attempt to secure their entire corporate IT environment for CUI.

That may expand the number of:

• Endpoints
• Applications
• Servers
• Users
• Locations
• Data flows
• External connections
• Controls and evidence sources

that must be assessed and maintained.

By placing CUI workflows within a clearly defined managed environment, an organization can reduce the CUI footprint and better understand what is in scope.

A smaller scope does not eliminate customer responsibilities. It can make those responsibilities more manageable.

Leverage inherited and shared security capabilities

Exostar’s managed FedRAMP Moderate Equivalent cloud-service environment provides significant inherited and shared security capabilities.

That can help organizations avoid building and operating the complete collaboration infrastructure themselves.

Customers still retain important responsibilities, including:

• Identifying CUI
• Determining contractual applicability
• Approving users
• Managing policies and procedures
• Training employees
• Addressing physical safeguards
• Managing organizational practices
• Operating customer-assigned controls
• Overseeing subcontractors
• Maintaining accurate assessments and affirmations

The objective is not to suggest that technology alone produces compliance.

The value is in reducing the infrastructure burden and giving customers a stronger technical foundation on which to implement their remaining requirements.

Support defensible assessments and affirmations

A secure environment is only one part of a defensible compliance program.

Organizations also need documentation and evidence that accurately explain:

• What is in scope
• Where CUI resides
• How users access it
• How applicable requirements are implemented
• Which capabilities are inherited or shared
• What the customer operates
• What evidence supports each conclusion
• What gaps remain

Exostar helps customers organize and maintain items such as:

• System Security Plans
• Policies and procedures
• Plans of Action and Milestones, where permitted
• Assessment results
• SPRS scoring support
• Control evidence
• Remediation records

The environment, documentation, assessment result, and affirmation should all tell the same story.

Stay adaptable as requirements evolve

The planned Phase II transition has been suspended, but the Department’s cybersecurity requirements will continue to evolve.

Organizations should avoid building a program around one assessment date.

A more sustainable strategy is to:

• Protect CUI now
• Maintain a manageable security boundary
• Assess the environment accurately
• Collect evidence continuously
• Keep documentation current
• Support applicable self-assessments and affirmations

Remain prepared for government review and future requirements

Exostar helps DIB companies create a tangible, defensible path to protecting CUI and meeting the evolving Department of War cybersecurity requirements.

Five Questions DIB Leaders Should Ask Today

Before submitting the next self-assessment result, SPRS score, affirmation, customer questionnaire, or cybersecurity representation, leadership should ask:

1. Do we know where our CUI actually lives?

Not only where policies say it should reside, but where it is truly stored, processed, transmitted, downloaded, and shared.

2. Can we support our assessment answers with objective evidence?

The organization should be able to connect material conclusions to configurations, records, procedures, logs, diagrams, training records, tickets, or other relevant artifacts.

3. Does our documentation match the actual environment?

The SSP, policies, diagrams, control descriptions, assessment scope, and operational practices should be consistent.

4. Does the affirming official have a reasonable basis for the affirmation?

The official should understand the assessed environment, supporting evidence, inherited and shared responsibilities, known gaps, and any material changes.

5. Could we simplify the problem by reducing where CUI is allowed to live?

A defined managed environment may reduce the number of systems, users, controls, and evidence sources the company must oversee.

An organization that cannot answer every question today should not panic.

The questions are intended to identify the right starting point.

The Best Response Is Accurate, Evidence-Based CUI Protection

Cybersecurity whistleblower cases and False Claims Act enforcement are important for DIB companies to understand.

But fear is not a cybersecurity strategy.

The lasting lesson from recent enforcement activity is that an organization’s contractual obligations, technical environment, documentation, self-assessment results, SPRS submissions, affirmations, and everyday operating practices should remain aligned.

The suspension of CMMC Phase II changed the planned expansion of third-party and government assessments. It did not eliminate the responsibility to protect CUI or the Phase I self-assessment requirements already in effect. (U.S. Department of War)

DIB organizations should use this period to strengthen the foundation:

• Control where CUI is stored, processed, and transmitted
• Reduce unnecessary CUI locations and workflows
• Implement applicable NIST SP 800-171 requirements
• Conduct accurate, evidence-based self-assessments
• Maintain current documentation
• Collect objective evidence continuously
• Address identified deficiencies
• Ensure affirmations remain supportable

A security deficiency can be identified and corrected.

The more difficult situation is allowing an unsupported representation to remain in place after the organization knows it may be inaccurate.

Exostar helps DIB organizations create a more controlled CUI environment, reduce their compliance footprint, leverage inherited and shared security capabilities, and build the documentation and evidence needed to support ongoing compliance.

The objective is not a superficial claim of readiness.

It is a tangible and defensible approach to protecting CUI today while remaining prepared for what comes next.