Cyber Compliance Under Fire: What Five Major FCA Cases Reveal
Building on last week’s discussion of Raytheon’s $8.4 million settlement, we’re now examining how that case fits into a broader trend in cyber FCA enforcement. As cyber FCA enforcement gains momentum, a pattern is emerging from recent U.S. Department of Justice (DOJ) settlements. Comparing Raytheon’s 2025 agreement to four other significant cyber-related False Claims Act (FCA) cases since 2019 reveals not just an uptick in government scrutiny—but a clear directional shift in how cybersecurity lapses in federal contracts, are evaluated and penalized. These cases serve as cautionary tales for defense contractors and cloud service providers operating in highly regulated environments.
Key Cyber FCA Settlements (2019–2025)
| Case (Year) | Settlement Amount | Triggering Issue | How DOJ Learned | Key Lessons |
|---|---|---|---|---|
| Cisco (2019) | $8.6M | Unpatched vulnerabilities in gov’t surveillance software | Subcontractor relator | First cyber FCA payout; suppliers are accountable |
| Aerojet Rocketdyne (2022) | $9M | Misrepresented NIST 800‑171 compliance on DoD/NASA contracts | Former CISO relator | Materiality of cyber compliance affirmed by court |
| Verizon (2023) | $4.1M | Missed TIC controls in Trusted Internet Protocol Service | Voluntary self-disclosure | Cooperation credit led to reduced penalty |
| MORSECORP (2025) | $4.6M | False SPRS scores; non‑compliant third‑party email provider | Head of Security relator | SPRS misstatements remain ripe for enforcement |
| Raytheon/Nightwing (2025) | $8.4M | Internal “DarkWeb” lacked SSP and NIST 800-171 controls | Engineering Director relator | Successor liability confirmed; development systems now under lens |
Comparative Insights
- Penalty Size Reflects Scope and Self-Reporting: Aerojet and Raytheon faced nearly identical penalties due to prolonged non-compliance. Verizon’s significantly lower fine reflects early self-reporting and cooperation, which earned DOJ leniency.
- Relators Drive Enforcement: Four of the five cases began with whistleblowers, highlighting the importance of internal reporting systems and timely remediation.
- Enforcement Focus Has Shifted: Early cases like Cisco targeted technical vulnerabilities. Recent actions emphasize broader failures—missing SSPs, inflated SPRS scores, and third-party control lapses tied to CMMC 2.0 compliance.
Enforcement Themes Across Cyber FCA Actions
1. Whistleblowers are the Front Line
Four of the five cyber FCA matters were initiated by relators—usually employees with insider knowledge. From engineers to CISOs, these whistleblowers spotlighted lapses in cybersecurity compliance that could have otherwise gone unchecked. The trend underscores the need for robust internal compliance and anonymous reporting systems.
2. Compliance Misstatements Invite Scrutiny
The DOJ’s interest in misrepresentations related to NIST 800-171 and SPRS scoring continues to grow. The Aerojet and MORSECORP cases illustrate how inflated compliance claims in proposals or scorecards can lead directly to cyber FCA investigations. Regulators no longer treat these disclosures as technicalities—they view them as actionable misrepresentations.
3. Cyber Risks Have Expanded
Early enforcement (e.g., Cisco) focused on product-level vulnerabilities. Now, cyber FCA cases increasingly involve broader systemic issues like missing SSPs, misrepresented compliance baselines, or third-party cloud misconfigurations—all issues directly tied to CMMC 2.0 implementation standards.
4. Settlement Size Reflects Behavior
Raytheon and Aerojet faced similar penalties—both approaching $9M—because of long-running non-compliance. Verizon, on the other hand, paid far less, thanks to proactive self-disclosure and cooperation. This pattern reinforces DOJ’s message: transparency can mitigate fallout in cyber FCA proceedings.
Conclusion: Cyber FCA Enforcement Has a New Playbook
The evolution of cyber FCA enforcement shows no sign of slowing. As the DOJ refines its playbook and expands its targets, it’s also casting a wider net—whether through whistleblower tips or regulatory audits. In response, organizations contracting with the federal government—especially those in defense, aerospace, or cloud services—must take notice. It’s no longer enough to have cybersecurity controls in place; organizations must thoroughly document and verify them. With relators increasingly motivated and regulators sharply focused on cyber risk, the need for proactive compliance has never been more urgent. Don’t wait for a relator to shine the spotlight. Instead, take action now. Let us help you strengthen your internal posture and avoid becoming the next headline.
For more information regarding this series overview, visit False Claims Act and Cybersecurity.
About RegDOX
At RegDOX Solutions Inc., we help defense contractors and high-security organizations simplify compliance with ITAR, EAR, DFARS, NIST SP 800-171, and CMMC requirements. Our secure, cloud-based platforms combine end-to-end encryption, access controls, and audit-ready documentation to keep your data—and your contracts—safe.
Need help navigating evolving cybersecurity regulations?
Request a Free Demo
Or contact us directly at info@regdox.com
See the enclave in action.
The Compliant Computing Enclave keeps CUI inside one boundary, with your endpoints out of scope and the evidence trail already built.
Talk to an Expert →