Overview
Cybersecurity requirements are often viewed primarily through the lens of information security. But for research organizations and others working with federal funding, contracts, or sensitive government information, failing to meet those requirements may create broader compliance risks.
A recent federal settlement provides a timely example of how cybersecurity obligations can intersect with the False Claims Act (FCA).
In the case, federal contractors agreed to a $13 million settlement to resolve allegations that they failed to comply with cybersecurity requirements contained in federal contracts. The allegations involved safeguarding Controlled Unclassified Information (CUI), implementing required cybersecurity controls, maintaining and updating system security plans, and addressing identified security deficiencies.
Federal authorities alleged that claims for payment were false or fraudulent because the contractors knew they had not complied with certain contractual cybersecurity requirements. The settlement resolved the allegations only, and no liability was determined.
The case offers a useful reminder: cybersecurity, information management, and organizational compliance may be more closely connected than they first appear.
Where Cybersecurity and Compliance Responsibilities Overlap
Organizations receiving federal funding, performing work under federal contracts, or handling sensitive federal information operate under requirements governing how they access, store, transmit, and protect information.
For organizations handling CUI, those obligations extend beyond technical safeguards. Policies, documentation, security planning, incident-response procedures, and ongoing oversight all contribute to an effective approach to protecting sensitive information.
In the recent settlement, for example, the allegations included storing CUI with a third-party cloud provider without ensuring that applicable security requirements were satisfied. Other allegations concerned system security plans and implementing cybersecurity controls in NIST Special Publication 800-171.
Meeting those requirements therefore involves more than securing networks and systems. It also requires organizations to understand the federal obligations attached to their work and establish processes to meet and document them.
Compliance Extends Beyond the IT Department
Protecting sensitive federal information is a shared institutional responsibility. Researchers and project teams need to understand when information is considered CUI and how to handle it. IT and information security teams support the systems and technical safeguards that protect it, while administrators, compliance professionals, and leadership help ensure contractual requirements, policies, and oversight remain aligned.
Organizations receiving or seeking federal funds need to understand the requirements associated with federal awards and contracts, as well as the risks that may arise when requesting federal payment or making representations concerning compliance.
The recent settlement illustrates that connection. In that matter, the government’s allegations tied compliance with contractual cybersecurity requirements to claims submitted for federal payment.
The broader lesson reaches beyond cybersecurity: information security, federal requirements, and organizational compliance are interconnected parts of managing institutional risk.
Building Awareness Through Training
Effective compliance depends on people across the organization understanding both their responsibilities and how those responsibilities connect.
CITI Program’s False Claims Act: A Primer and Guide for Research Organizations helps learners understand the FCA and Civil Monetary Penalties Law, recognize common risk factors, explore ways to mitigate risk, and consider how organizations should respond when potential issues arise. The course addresses these topics specifically in the context of federally funded research and research organizations.
The Controlled Unclassified Information (CUI) course provides researchers, institutional administrators, IT leadership, and staff with practical guidance on identifying, safeguarding, and managing CUI in research. Topics include NIST SP 800-171, CMMC, cybersecurity controls, system security planning, incident reporting, institutional responsibilities, and information security practices.
Together, the courses address distinct but potentially interconnected areas of federal compliance. A stronger understanding of both helps organizations recognize where responsibilities intersect and where compliance vulnerabilities may emerge.
Explore CITI Program training on the False Claims Act and Controlled Unclassified Information to strengthen compliance awareness across your organization.
