Contractor Settles False Claim Allegations Over Cybersecurity Violations

Alabama defense contractor, LOGZONE, Inc. (LOGZONE), which provides logistics services, has agreed to pay $507,144 to resolve allegations brought under the False Claims Act (FCA) that LOGZONE knowingly failed to comply with cybersecurity requirements in two U.S. Navy contracts.

LOGZONE’s Navy contracts included Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012. The clause requires contractors to provide adequate security on all covered contractor information systems, including, at a minimum, the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171.  Additionally, the contracts required that LOGZONE enter a summary level score of a current NIST SP 800-171 self-assessment in the Supplier Performance Risk System (SPRS).  Assessment scores may range from -203 to a high of 110. The contracts also permitted the government to conduct its own assessment of LOGZONE’s implementation of NIST SP 800-171 security controls.

In Fall 2021, LOGZONE entered a self-assessment score of 110 – the highest score – in SPRS.  In February 2024, the government conducted its own assessment of LOGZONE’s compliance and scored LOGZONE a -170. This led to claims that LOGZONE knowingly submitted or caused to be submitted claims for payment to the Navy that were false. Specifically, LOGZONE submitted claims for reimbursement under the contracts despite knowing that it had not fully implemented all the security controls listed in NIST SP 800-171 and, thus, knew that it was not in compliance with DFARS 252.204-7012.

This is yet another stark reminder that the government is aggressively scrutinizing the Defense Industrial Bases’ compliance with required cybersecurity controls and pursuing those contractors that are putting sensitive information at risk of exploitation. LOGZONE now joins several other companies that have faced the government’s wielding of the FCA to hold companies accountable for failing to comply with cybersecurity control measures. It is imperative that contractors take heed and ensure compliance because there is no sign that the government’s enforcement is slowing down anytime soon.

If you have any questions regarding cybersecurity controls and requirements in federal contracting or any other matters related to contracting with the federal government, please contact any member of the Government Contracting Group.