By Austin Justice, Vice President, Justice IT Consulting | Last updated: October 2026

Yes, it can. Your SPRS score is a representation to the government that you've implemented NIST SP 800-171, and the Department of Justice has used the False Claims Act to pursue contractors whose posted scores didn't match reality. In June 2026, Huntsville, Alabama contractor LOGZONE agreed to pay $507,144 to resolve allegations tied to a self-reported score of 110 that a later government assessment placed at -170. With third-party CMMC checks paused, your own claim is what the government relies on, which raises the stakes of getting it right.

This article is general information for contractors, not legal advice. If you have a specific concern about a past score or affirmation, talk to qualified counsel.

At Justice IT Consulting, a CMMC Level 2 certified Registered Practitioner Organization in Burleson, Texas, we help Dallas-Fort Worth defense manufacturers test whether their posted score holds up before the government does. Here is what recent cases show.

Why the Pause Raises the Stakes

The 2026 CMMC Phase 2 suspension changed certain federal contracting requirements for third-party assessments; it did not erase contractual safeguarding duties or the importance of truthful assessment submissions. A NIST SP 800-171 assessment result in SPRS and a CMMC status affirmation are related but distinct records with different procedural requirements. Contractors should determine which submissions their specific contracts require, who approved them, and what evidence supports each claim. The risk illustrated by recent enforcement actions is not a low number by itself, but an inaccurate representation that is material to government contracting or payment decisions.

What the LOGZONE Case Shows

According to the settlement agreement and law firm analyses, LOGZONE posted a perfect SPRS score of 110 in October 2021. In February 2024, a Defense Contract Management Agency (DCMA) DIBCAC Medium Assessment produced a score of -170, near the bottom of the possible range of -203 to 110. DOJ's allegations covered claims for payment submitted from May 2021 through March 2025 on two Navy contracts, and the settlement resolved those allegations without a court finding.

Two details matter for every contractor. First, Crowell & Moring notes that this settlement did not arise from a whistleblower complaint but from a government-initiated assessment, so audits now double as investigative tools. Second, the issue wasn't a low score. It was the distance between the claimed score and the assessed one.

The Pattern Across Recent Cases

Matter Reported outcome What drew scrutiny
LOGZONE (June 2026) $507,144 settlement Self-reported 110 versus a government-assessed score of -170
MORSECORP (March 2025) $4.6 million settlement Posted score of 104 versus a consultant-assigned -142 that went uncorrected in SPRS for almost a year; non-compliant third-party email hosting
Raytheon and Nightwing (May 2025) $8.4 million settlement Alleged cybersecurity non-compliance from 2015 to 2021; Nightwing, which later acquired the business, was a party to the settlement
Penn State (October 2024) and Georgia Tech (September 2025) $1.25 million and $875,000 Research institutions resolving cybersecurity compliance allegations

Sources: DOJ announcements for MORSECORP, Raytheon and Nightwing, Penn State, and Georgia Tech. MORSECORP and Raytheon began as whistleblower (qui tam) cases, while LOGZONE grew out of the government's own assessment.

DOJ launched its Civil Cyber-Fraud Initiative in October 2021, and Mayer Brown counted fifteen civil cyber-fraud settlements as of March 2026, with more than half in fiscal year 2025. LOGZONE came after that count. According to Mayer Brown, DOJ no longer refers to the initiative by name publicly, but the enforcement pattern has continued.

What Tends to Create the Problem

  • Posting a score that overstates implementation, such as claiming a control that exists only as a written policy
  • Learning your real score is lower and not updating SPRS promptly. In the MORSECORP matter, the delay itself was part of the story
  • Using cloud or email services that don't meet the required security standard while certifying compliance
  • Treating the annual affirmation as paperwork instead of a statement a senior official is personally attesting to
  • Relying on a score that nobody has independently tested

Practical Safeguards

Related Justice IT resources: How POA&Ms affect SPRS scores | CMMC compliance services | What the class deviation changed

These are common-sense steps, not a substitute for counsel:

  • Test your score against reality. Compare the number in SPRS with what is actually implemented, control by control. Some law firms suggest doing this through a privileged internal review, so ask your attorney how to structure it
  • Correct errors quickly. If you find your posted score is wrong, update it and document why, rather than letting it stand
  • Keep evidence. A score is only defensible if you can show screenshots, configurations, logs, and policies that support each control
  • Use your POA&M honestly. An accurate score with a credible, dated plan to close gaps is a defensible position. An inflated score is not (see how POA&Ms affect your SPRS score)
  • Brief your Affirming Official. The person signing should understand what they're attesting to and who verified it
  • Check your vendors. Cloud, email, and managed service providers handling CUI have to meet the requirements too

Why a High Score Isn't the Goal

It's tempting to chase 110. The goal is an accurate score. A perfect number that nobody has tested draws more attention than a lower number backed by evidence and a plan, which is why an independent review before a government assessment is cheaper than learning the difference afterward. Justice IT Consulting's DFARS compliance reviews are built for exactly that check.

Frequently Asked Questions

Can an inaccurate SPRS score lead to a False Claims Act case?

Yes. Your SPRS score represents to the government that you've implemented NIST SP 800-171. DOJ has used the False Claims Act against contractors whose posted scores didn't match reality, including LOGZONE's $507,144 settlement in June 2026 over a self-reported 110 that a government assessment scored at -170.


What should I do if my posted SPRS score is wrong?

Correct it promptly and document why. In the MORSECORP case, DOJ cited roughly 11 months between learning the score was -142 and correcting a posted 104. Talk to qualified counsel about how to structure the review, since some law firms recommend doing it under privilege.


Is a low SPRS score a False Claims Act risk?

Not automatically. A low, accurately calculated NIST SP 800-171 assessment score does not by itself establish fraud. Risk can arise when a contractor knowingly makes or maintains a materially false statement about cybersecurity compliance in connection with a government claim. POA&Ms have their own eligibility and completion rules; an accurate score and documented remediation plan are useful but are not a legal safe harbor. Consult counsel about particular facts.


Do I still need to affirm my SPRS score during the CMMC pause?

Don't assume that posting an NIST SP 800-171 assessment score and making a CMMC annual affirmation are the same action. Confirm which SPRS submission and affirmation requirements apply to your award, assessment level, and current governing clauses. The Phase 2 suspension did not erase applicable self-assessment, recordkeeping, or safeguarding obligations.


Who can review my SPRS score before the government does?

Justice IT Consulting, a Registered Practitioner Organization in Burleson, Texas with Certified CMMC Professionals on staff, provides independent SPRS scoring reviews for Dallas-Fort Worth defense contractors. We compare your posted score to what's actually implemented, control by control, and help you correct and document gaps.

How Justice IT Supports Accurate Readiness Reviews

  • Justice IT Consulting is a Burleson-based Registered Practitioner Organization serving DFW defense contractors. Our team helps organizations verify assessment evidence, document gaps, and prepare practical remediation plans. Confirm current credentials and any published recognitions before publishing.

Not sure your posted SPRS score matches what's actually implemented? Book an independent scoring review with Justice IT Consulting. We'll show you the gap while you can still fix it.

About the Author

Austin Justice is Vice President of Justice IT Consulting, a CMMC Level 2 certified Registered Practitioner Organization in Burleson, Texas, and the Amazon best-selling author of The Compliance Formula: The Definitive Guide to Understanding and Implementing CMMC. He started freelancing in IT in high school, where he earned five IT certifications before graduating, competed nationally in Cisco Networking, and became one of only six youth in the nation certified as a Panduit fiber and copper technician. Since then he has pulled cable, worked the help desk, designed network infrastructure, and consulted with companies during and after cyber breaches. His certifications span Cisco, SonicWALL, networking, hardware, and fiber and copper technologies. Off the clock, Austin and his family raise Santa Gertrudis cattle.

Sources / Further Reading