The Defensible Position
Under self-attestation the False Claims Act does not punish being wrong. It punishes being knowingly wrong — so the record behind your score is the defense.
With CMMC Phase II suspended (Department of War, 13 July 2026), a DoD contractor self-assesses and the affirming official personally signs the SPRS score. No C3PAO validates it. Only the Department of Justice and whistleblowers do — after every invoice under that score has already been submitted.
The exposure is real, and it is enforced
Each invoice submitted under a false attestation is a separate claim, and each claim carries a civil penalty of $14,308–$28,619 — on top of treble (3×) damages. A single $1M contract billed across 36 invoices reaches roughly $3.5–4M of exposure. That is arithmetic on the statute, not a settlement figure — but the settlements are real:
| Contractor | Settlement | Year | What they did |
|---|---|---|---|
| MORSECORP | $4.6M | 2025 | Reported an SPRS score of 104; the true score was −142, and it sat on the correction. |
| Health Net Federal | $11.25M | 2025 | Falsely certified cybersecurity compliance on a DoD TRICARE contract. |
| Raytheon / RTX | $8.4M | 2025 | No compliant System Security Plan on a system used for DoD work. |
| Aerojet Rocketdyne | $9.0M | 2022 | Misrepresented DFARS 252.204-7012 compliance. |
| Penn State | $1.25M | 2024 | Non-compliant scores and failure to develop and implement POA&Ms. |
| Georgia Tech | $875K | 2025 | A score built on a “fictitious” environment not tied to any real system. |
DoJ’s Civil Cyber-Fraud Initiative settled $51.85M across eight cases in 2025 alone — up 233% over 2024. Many were tipped by a whistleblower, who is entitled to 15–30% of the recovery.
Liability attaches to the false statement — not to the gaps
A score below 110 is not a false claim. DFARS 7012 and NIST SP 800-171 expressly allow a Plan of Action & Milestones for controls not yet implemented. The FCA’s “knowing” standard is actual knowledge, deliberate ignorance, or reckless disregard (31 U.S.C. §3729(b)(1); Schutte v. SuperValu, 2023 — judged on your subjective belief at the time). What sinks contractors is misreporting, a fake environment, or no plan.
An honest score of your real systems
Scanned from the hosts you actually run — not a fictitious environment. The number you sign is the number that is true.
Signed, tamper-evident evidence
Proof the posture was real at the moment you attested — the difference between “your score was wrong” and a documented, good-faith assessment.
A genuine POA&M for the gaps
The remediation plan the law contemplates — and the exact thing Penn State was penalized for lacking.
The math
ForteFide costs a few thousand dollars. The exposure it removes runs from $875K to $11M+ in real settlements. A ForteFide year costs less than a whistleblower’s share of the smallest case on that list. Everyone else helps you claim a score; ForteFide helps you prove it.