What does the DOJ MORSECORP settlement signal contractors must change in cybersecurity compliance?
DOJ's MORSECORP settlement shows contractors need verified NIST SP 800-171 implementation, written plans, vendor oversight, and prompt score correction.
AI-assisted and automatically checked against the linked primary sources.
What compliance changes does the DOJ settlement signal?
What was the central enforcement issue?
Important Note
DOJ highlighted a long delay between learning the NIST SP 800-171 score was wrong and updating the DoD reporting system. Contractors should treat known inaccuracies in cybersecurity reporting as urgent compliance issues.
Process
- 1
Review contract cybersecurity requirements
Confirm the controls, reporting duties, and documentation required by each contract before you certify compliance.
- 2
Check third-party hosting arrangements
Require any outside email or hosting provider to meet equivalent security requirements and DoD incident-reporting, malware, media preservation, and forensic support duties.
- 3
Maintain current documentation and reporting
Keep a consolidated written system security plan and correct any reported cybersecurity score or assessment data as soon as you learn it is inaccurate.
- DOJ used the False Claims Act to enforce contract cybersecurity requirements in the MORSECORP settlement.
- Full implementation of NIST SP 800-171 controls mattered; partial implementation was not enough.
- A consolidated written system security plan was required and missing documentation became part of the alleged noncompliance.
- Third-party email hosting had to meet equivalent security and incident-reporting obligations, and reported scores had to be corrected when known to be wrong.
Reconcile your current controls, written plans, third-party arrangements, and reported cybersecurity scores against your contract requirements.
Sources & Citations
Related Articles
What Should Contractors Review in CISA’s AI Procurement Guidance?
CISA’s procurement guidance says buyers should review product security, incident response, data protection, and supply chain risk—not just enterprise compliance.
Read more →What Compliance Questions Arise When a U.S. Weapons Program Moves Overseas?
Foreign production can trigger DFARS foreign-license, export-control, patent/data-rights, and overseas-performance questions, plus ITAR and EAR compliance duties.
Read more →What Do GAO Findings on Body-Worn Camera Programs Mean for Border and Law Enforcement Contractors?
GAO found program-management gaps at CBP and ICE, while FAR clauses govern contractor safeguards and Privacy Act obligations when those contract conditions apply.
Read more →