What does the DOJ MORSECORP settlement signal contractors must change in cybersecurity compliance?
DOJ's MORSECORP settlement shows contractors need verified NIST SP 800-171 implementation, written plans, vendor oversight, and prompt score correction.
AI-assisted and automatically checked against the linked primary sources.
What compliance changes does the DOJ settlement signal?
What was the central enforcement issue?
Important Note
DOJ highlighted a long delay between learning the NIST SP 800-171 score was wrong and updating the DoD reporting system. Contractors should treat known inaccuracies in cybersecurity reporting as urgent compliance issues.
Process
- 1
Review contract cybersecurity requirements
Confirm the controls, reporting duties, and documentation required by each contract before you certify compliance.
- 2
Check third-party hosting arrangements
Require any outside email or hosting provider to meet equivalent security requirements and DoD incident-reporting, malware, media preservation, and forensic support duties.
- 3
Maintain current documentation and reporting
Keep a consolidated written system security plan and correct any reported cybersecurity score or assessment data as soon as you learn it is inaccurate.
- DOJ used the False Claims Act to enforce contract cybersecurity requirements in the MORSECORP settlement.
- Full implementation of NIST SP 800-171 controls mattered; partial implementation was not enough.
- A consolidated written system security plan was required and missing documentation became part of the alleged noncompliance.
- Third-party email hosting had to meet equivalent security and incident-reporting obligations, and reported scores had to be corrected when known to be wrong.
Reconcile your current controls, written plans, third-party arrangements, and reported cybersecurity scores against your contract requirements.
Sources & Citations
Related Articles
What Do GAO Findings on Body-Worn Camera Programs Mean for Border and Law Enforcement Contractors?
GAO found program-management gaps at CBP and ICE, while FAR clauses govern contractor safeguards and Privacy Act obligations when those contract conditions apply.
Read more →How Can the False Claims Act Expose Federal Contractors Beyond the Federal Level?
DOJ, FAR rules, and cost principles show FCA risk can extend to state, local, and governmentwide consequences, plus disclosure duties and exclusion exposure.
Read more →How Will FedRAMP's 2026 Overhaul Change Cloud Authorization for Contractors?
FedRAMP now centers reusable certification packages, recognized assessors, significant-change notifications, and ongoing monitoring, with key dates in 2027.
Read more →