The False Claims Act Exposure in Your SPRS Score

Most small contractors think about their SPRS score as a gate. You need a number posted to win the contract, so you post a number. That framing misses what the number turns into once it’s in the system: a statement of fact you made to the federal government, which can follow you for up to ten years.

I covered how the score is calculated in SPRS Scoring Explained. This post is about the other side of it: how a score becomes a False Claims Act case, what the law actually requires the government to prove, and what the most recent settlements tell you about who gets caught. One caveat up front. I’m not a lawyer, and nothing here is legal advice. If you think you have exposure, call one.

How a number becomes a claim

The False Claims Act, at 31 U.S.C. 3729, makes it a violation to knowingly present a false claim for payment to the government, or to knowingly make a false record or statement that’s material to one. Your SPRS score doesn’t look like an invoice. That’s the point people miss.

Here’s how the pieces connect. DFARS 252.204-7019 says that to be considered for award, an offeror required to implement NIST SP 800-171 must have a current assessment (no more than three years old) posted in SPRS. Under DFARS 204.7303, the contracting officer has to verify that score before award and again before exercising an option. So the score is a condition of getting the work. Every invoice you submit afterward carries an implied message: we’re the contractor you thought you were hiring, meeting the requirements you made a condition of the deal.

That’s called implied certification, and the Supreme Court endorsed the theory in Universal Health Services v. Escobar in 2016. A claim can be false when it makes specific representations about the goods or services and leaves out material noncompliance, which the Court called a misleading half-truth. You don’t have to sign anything that says “I certify” on each invoice for the theory to work.

Two consequences follow from that, and both are bigger than most people expect.

Every invoice can count. The penalty is per claim, on top of the damages. Under 28 CFR 85.5, the current range for penalties assessed after 3 July 2025 is $14,308 to $28,619 per claim. A three-year contract billed monthly is thirty-six invoices. Do the arithmetic before you decide this is a rounding error.

Damages are tripled. The statute provides for three times the government’s damages. There’s one exception worth remembering, and I’ll come back to it: damages can drop to double if you report the problem yourself within thirty days and cooperate fully.

“Knowingly” is a lower bar than it sounds

This is the part that catches honest companies. The FCA’s definition of “knowingly” isn’t limited to lying on purpose. It covers actual knowledge, but also deliberate ignorance and reckless disregard of the truth, and the statute says plainly that no proof of specific intent to defraud is required.

Think about what that means for a self-assessment. If your score was produced by someone who skimmed the 110 requirements on a Friday afternoon, checked “implemented” on anything that sounded familiar, and never looked at an actual configuration, a court could find that was reckless disregard. You didn’t intend to deceive anyone. You just didn’t bother to find out. Under this statute, that can be enough.

The real defense is a process you can show later: a written record of who did the assessment, when, against what scope, and with what evidence.

Materiality is the government’s real hurdle

To be fair to the other side, Escobar also made the government’s job harder. The Court called the materiality standard “demanding.” Minor or insubstantial noncompliance doesn’t qualify, and if the government keeps paying in full while knowing about a violation, that’s strong evidence the requirement wasn’t material.

Don’t take too much comfort from that, though. Cybersecurity requirements are about the hardest kind to argue are immaterial right now. DoD made the score a gate for award, built an assessment program around it, and has written repeatedly about the threat to the defense industrial base. A two-point difference over a single control is one thing. A posted score of 110 against an actual negative score is not a close call.

Who’s been caught lately

The earlier cases (MORSECORP, Georgia Tech, LOGZONE) are in my SPRS post. The more recent ones fill in the picture, and they point at a broader target than the large primes.

Penn State, October 2024, $1.25 million. The government’s allegations weren’t just about a wrong score. They included misrepresenting the dates by which controls would be implemented, across fifteen DoD and NASA contracts. The relator was a former CIO of the university’s Applied Research Laboratory, who received $250,000. The lesson for small shops: a POA&M date you never intended to meet is its own kind of false statement.

Aero Turbine and Gallant Capital, July 2025, $1.75 million. A California defense contractor and the private equity firm that owned it settled allegations that NIST 800-171 controls weren’t implemented and that controlled information was shared with a software company in Egypt. Two details stand out. The PE owner was named in the settlement, which should get the attention of anyone with investors. And DoJ gave the companies credit for disclosing the problem themselves.

Swiss Automation, December 2025, $421,234. An Illinois precision machining company, working as a subcontractor, received controlled drawings from its primes without meeting NIST 800-171. A whistleblower filed the case and received $65,291. If you run a machine shop and assumed these cases were about universities and big defense firms, this is the one to read.

Honeywell Aerospace, September 2026, about $2.04 million. The allegation covered NIST 800-171 noncompliance on one network, from April 2020 to December 2023. A former employee filed the case and received $375,823.

The two numbers that should change how you think

The first is the relator share. Under 31 U.S.C. 3730(d), a whistleblower gets 15 to 25 percent of the recovery if the government joins the case, and 25 to 30 percent if it doesn’t. Most of the cases above were filed by an insider, like a former CIO or a former employee. The person most likely to file a case about your score is someone who knows how it was produced, and the law pays them to do it.

The second is the statute of limitations, which is longer than people assume. Under 31 U.S.C. 3731(b), a case can be brought within six years of the violation, or within three years of when the responsible government official knew or should have known the facts, up to an outer limit of ten years. Whichever is later applies.

Put those together. The first big wave of SPRS scores went up in late 2020 and 2021, after the interim DFARS rule took effect. A score posted then, and the invoices billed under it, can still be within reach in 2030. The Honeywell conduct period started in April 2020. Your old score didn’t expire when you posted a new one.

The CMMC suspension didn’t lower the stakes

In July 2026, DoD suspended Phase 2 of CMMC, and a September class deviation directed contracting officers to remove third-party assessment requirements from solicitations and contracts. It’s tempting to read that as permission to relax.

It means the opposite. Self-assessments, SPRS posting and DFARS 252.204-7012 are all still in place. Under DFARS 252.204-7021, where it’s in a contract, an affirming official has to complete an annual affirmation of continuous compliance in SPRS. With the third-party audit gone, your own score and your own affirmation are the main evidence the government has about your security. That’s a lot of weight on a number you produced yourself.

If you think your current score is wrong

Some readers will finish this and realize the number in SPRS isn’t one they’d want to defend. Don’t panic, and don’t quietly edit it and hope nobody notices.

Talk to a lawyer who handles government contracts before you change anything. How you correct the record matters, and the self-disclosure provisions reward doing it in a specific way. Then reassess properly, with a documented method, and decide with counsel how to correct the score and what, if anything, to disclose. The companies in the worst positions in these cases weren’t the ones with low scores. They were the ones who knew the score was wrong and left it alone.

Making your score defensible

None of this argues for posting a low score out of fear. It argues for posting a true one and being able to show your work.

• Write down the method. Who assessed, on what dates, against which systems, using what evidence. Keep it with the score.
• Score the environment you actually run. Georgia Tech’s score was tied to a campus-wide environment that DoJ called fictitious. Your scope statement has to match the real boundary where CUI lives.
• Give the POA&M real dates. If a fix needs a budget you don’t have yet, say so and pick a date you can meet.
• Update the score when you learn it’s wrong. The longest stretch of exposure in these cases is usually the gap between when the company knew and when it corrected the record.
• Treat self-disclosure as a real option. The double-damages provision and the credit given to Aero Turbine both reward companies that find and report their own problems.
• Check your subs. DFARS 252.204-7020 requires a prime to make sure a subcontractor has a current assessment posted before awarding a subcontract. Your supplier’s score is your problem too.

The honest score is also the cheapest one. A modest number with a credible plan is a business conversation with a prime. An inflated number with nothing behind it is a liability that grows with every invoice.

---

Where to go next

• Not sure your score would hold up? The CMMC readiness quiz takes about five minutes.
• Our CMMC guide for small contractors walks through scoping and scoring from the beginning.
• Need the SSP and POA&M that make a score defensible? Start with our CMMC packets.