You don’t need a data breach to commit False Claims Act fraud. You just need a cybersecurity certification that isn’t true.

Honeywell Aerospace just paid more than $2 million to resolve allegations that, from April 2020 through December 2023, it billed on a Defense Department contract while failing to meet the cybersecurity standard known as NIST SP 800-171, the standard for protecting controlled unclassified information.

Those are allegations only. There was no finding of liability.

But notice what’s missing from the story: a breach.

DOJ’s theory is simpler. If you certify compliance to get paid and it is inaccurate, every payment claim can be a false claim.

And notice who started this case: a whistleblower, a former employee who received more than $370,000 of the recovery.

Cyber fraud cases are often brought by the insiders who see the gap between what the company tells the government and what its network actually looks like.

If you hold defense contracts, don’t rely on point-in-time attestation.

Independently verify your controls. Take internal security concerns seriously, and remember this exposure can run quietly for years across many billing cycles.

The risk is rising, not falling.

The Ethics and Compliance Q and A show is produced by One Stone Creative.