The U.S. Department of Justice (DOJ) has once again reinforced a critical message for the federal contracting community: Cybersecurity compliance is no longer simply a contractual obligation. It is increasingly becoming a False Claims Act enforcement priority that can expose government contractors to significant financial liability. In a recently announced settlement, a defense contractor agreed to pay more than $500,000 to resolve allegations that it knowingly failed to comply with cybersecurity requirements incorporated into contracts with the Department of the Navy while continuing to submit claims for payment. The case serves as yet another reminder that federal agencies and enforcement authorities are actively scrutinizing contractor compliance with cybersecurity obligations, particularly those tied to safeguarding sensitive government information. This latest enforcement action underscores a growing reality for companies operating in the defense industrial base. Cybersecurity failures can now create not only operational and contractual risk, but also substantial exposure under the False Claims Act. The Government’s Cybersecurity Enforcement Focus Continues to Intensify According to the DOJ, the contractor allegedly failed to fully implement required security controls under NIST Special Publication 800-171, the cybersecurity framework that governs how contractors must protect Controlled Unclassified Information (CUI) across nonfederal systems. The alleged compliance failures occurred over a period spanning nearly four years, during which the contractor continued performing under Navy contracts and submitted invoices for payment despite purportedly failing to implement required cybersecurity safeguards. The contractor’s alleged deficiencies were identified during an assessment conducted by the Defense Contract Management Agency, which reportedly issued the contractor an assessment score of negative 170 under the Department of Defense’s cybersecurity scoring methodology. For context, scoring under the assessment framework ranges from negative 203 to positive 110, making a score this low particularly significant from an enforcement perspective. The government alleged that unimplemented security controls created material vulnerabilities