Navigating the hidden False Claims Act trap in CMMC self-attestation

Cybersecurity Maturity Model Certification (CMMC) self-attestation can create False Claims Act (FCA) exposure when annual compliance affirmations lack supporting evidence.

Understanding how to support self-attestation may help contractors reduce risk and maintain confidence in their compliance posture.

The hidden risk in CMMC self-attestation

As CMMC requirements continue rolling out across the defense industrial base (DIB), contractors are facing a significant change in the program’s implementation timeline. The Defense Department on July 13, 2026, putting the planned Nov. 10 expansion of third-party assessments on hold effectively immediately while the department conducts a 60-day review of the program. Phase One requirements, including applicable self-assessments, remain in force. Phase Two was scheduled to expand mandatory certified third-party assessor organization (C3PAO) assessments across a broader range of contracts beginning Nov. 10, 2026, but DoD has now suspended those requirements until further notice.

For most defense contractors, Level 2 certification is the primary requirement because it applies to entities that handle controlled unclassified information (CUI) and requires implementing all 110 security requirements in National Institute of Standards and Technology Special Publication 800-171 Rev. 2. However, DoD’s July suspension means the broader rollout of third-party assessments is currently on hold. During the suspension, DoD says it and select government-led assessments.

That is where a less-visible risk can emerge. Security environments change continuously as personnel move into new roles, systems receive updates, software is introduced, configurations shift and new threats appear. Maintaining compliance requires ongoing oversight long after an assessment has been completed.

The recent suspension of Phase Two does not remove that concern. It keeps self-assessment an important part of the current compliance environment while DoD reviews how CMMC should work going forward. Contractors still need to understand what they are representing when they affirm compliance and whether they have sufficient evidence to support those representations.

The stakes can be significant when executives submit annual affirmations without sufficient evidence that controls remain in place and are operating effectively. If a cyber incident later triggers an investigation and compliance gaps are found, those representations may face scrutiny under the FCA. The act provides that anyone who knowingly submits or prompts the filing of false claims to the government must repay three times the financial harm caused to the government in addition to inflation-adjusted penalties.

Building an audit-ready compliance program

The strongest safeguard against unsupported affirmations is a compliance program that produces reliable evidence throughout the certification cycle. When companies can demonstrate how controls are monitored, reviewed, documented and validated over time, executives are better positioned to make informed attestations and respond to questions about their compliance posture if scrutiny arises later.

Create continuous visibility into security controls

Continuous monitoring provides the foundation for maintaining compliance between formal assessments. Many CMMC requirements involve controls that require ongoing attention. Enterprises need to manage user access, identify and address vulnerabilities, ensure configurations remain secure, and monitor and investigate security events. Regular oversight of these activities helps them understand if controls continue to function as intended.

This level of visibility can also help identify gaps before they become larger issues, as demonstrated by a recent Justice Department settlement. A logistics provider based in Alabama agreed to pay to resolve allegations that it misrepresented its compliance with DoD cybersecurity while performing work for the Navy.

According to the Justice Department, the company allegedly failed to implement certain NIST SP-800-171 controls over several years despite contractual requirements to do so. The case shows how compliance challenges can develop over time when businesses lose visibility into whether required controls remain fully implemented and operating as expected.

Conduct recurring internal audits

While continuous monitoring offers operational awareness, internal audits help verify that compliance activities align with documented requirements. Periodic reviews can assess how technical controls, policies, procedures and evidence continue to meet CMMC expectations. These assessments also provide an opportunity to identify changes in systems, processes or personnel that may affect compliance.

Documented audit findings and remediation activities create a record of oversight that can support executive decision-making. They also help organizations evaluate the completion of corrective actions and the ongoing effectiveness of security controls throughout the certification cycle.

Seek independent validation

Under the existing CMMC framework, entities with a three-year Level 2 assessment cycle their continued compliance in the intervening years without undergoing another full assessment. Bringing in an outside party to evaluate NIST SP-800-171 implementation, review supporting evidence and identify potential gaps can provide leadership with an objective basis for that affirmation.

Recent enforcement actions demonstrate why this step deserves particular attention. MORSECORP Inc. allegations that it violated the FCA by overstating its implementation of required cybersecurity controls. Its reported cybersecurity posture differed materially from findings later identified during an independent assessment.

An external review before a senior official signs an affirmation can therefore help identify discrepancies between a company’s reported posture and its actual implementation to reduce the risk of unsupported representations.

Maintain current documentation

Documentation serves as the evidence behind a compliance program. System security plans, plans of action and milestones, risk assessments, policies, procedures, inventories and training records help demonstrate how security requirements are being implemented and maintained.

As systems and personnel responsibilities change, those updates should be reflected in documentation. Regular reviews and clearly assigned ownership can help ensure records remain accurate and current. Up-to-date documentation also gives executives a stronger foundation when evaluating annual affirmations because it provides a clear record of compliance activities and control implementation.

Before signing the dotted line

The hidden FCA trap in CMMC self-attestation emerges when there is a gap between what an enterprise reports and what it can demonstrate. Although DoD has suspended Phase Two while it reviews the CMMC program, Phase One self-assessment requirements remain in force. Continuous monitoring, recurring audits, independent validation and current documentation can help contractors maintain a clear record of compliance and give executives stronger evidence when making those affirmations.

Dylan Berger, a digital content consultant writing on behalf of CBIZ Pivot Point Security, has over five years of experience writing in the industry with bylines at Global Trade Mag and Tripwire. 

Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.