DOJ False Claims Act (FCA) settlements related to cybersecurity typically have focused on false representations by a government contractor of its compliance with cybersecurity requirements. A recently announced settlement shows that private equity owners are not immune from potential FCA liability.

Cybersecurity requirements for contractors doing business with the U.S. federal government are nothing new. 

On January 15, 2025, the Federal Acquisition Regulation (FAR) Council issued a proposed cybersecurity rule to implement the National Archives and Records Administration’s (NARA) Controlled Unclassified Information (CUI) Program across all federal agencies.  This Proposed Rule (Proposed Rule) will impose requirements on all federal contractors that are substantially similar to those that DOD contractors and subcontractors have wrestled with for many years.