A sub-110 score is not a false claim
The law expects a POA&M. What it punishes is the false statement — not the honest gap.
A common fear stops contractors from self-assessing honestly: “if my score isn’t 110, am I admitting a false claim?” No — and the law is explicit about why.
DFARS 252.204-7012 and NIST SP 800-171 contemplate a Plan of Action & Milestones for controls not yet implemented. A truthful score below 110 with a real, executed POA&M is compliant conduct, not fraud. The False Claims Act attaches to a false statement made knowingly — actual knowledge, deliberate ignorance, or reckless disregard (31 U.S.C. §3729(b)(1)). The Supreme Court’s Schutte v. SuperValu (2023) fixed that on the defendant’s subjective belief at the time.
So the liability line is bright:
- Reporting a score you know is inflated (MORSE: 104 vs −142)
- A score built on a system that doesn’t exist (Georgia Tech)
- No POA&M for the gaps you have (Penn State)
- An honest score of your real configuration
- Signed evidence it was true when you signed
- A genuine POA&M you actually work
Honesty plus a plan is not exposure. It is the defense.