What the DIB is actually up against — sourced.
Short, cited reads on CMMC self-attestation, False Claims Act exposure, and the defensible record that separates an honest score from a costly one.
The Defensible Position
Under self-attestation the False Claims Act does not punish being wrong. It punishes being knowingly wrong — so the record behind your score is the defense.
The audit is paused. What you affirm is not.
CMMC Phase II is suspended — but self-assessment, the SPRS affirmation, and False Claims Act liability are all still in force.
The DIB reality check
~80,000 contractors need CMMC Level 2. Almost none of them are ready. The numbers, sourced.
Cyber-fraud settlement watch
DoJ's Civil Cyber-Fraud Initiative settled $51.85M across eight cases in 2025 — up 233% over 2024. A running tally of what misreporting actually costs.
A sub-110 score is not a false claim
The law expects a POA&M. What it punishes is the false statement — not the honest gap.