DODs Cybersecurity Rule May Help Fend Off FCA Claims

Ryan Burnette, a special counsel with Covington & Burling focused on government contracts and technology, was quoted in Law360 in an article examining how the U.S. Department of Defense’s requirement for certain contractors to have a third-party assessor review their cybersecurity compliance — implemented in a final rule under the Cybersecurity Maturity Model Certification (CMMC) program — could help contractors protect themselves from False Claims Act enforcement.

Law360 reported that while third-party assessors can help with ensuring compliance, Ryan said companies also need to make sure that they don’t run afoul of their compliance certification by making changes to their systems after having a third-party assessment.

"Companies really have to focus closely on these requirements and not only make sure that they’re implementing them as the rule goes into effect, but also maintaining implementation of these requirements going forward as they do business with DOD,” Ryan said.