DOJ cybersecurity contract enforcement targets misrepresentation with $52 million in settlements

This enforcement shift forces streaming and IT infrastructure providers to move beyond generic compliance language toward granular, auditable data classification schedules. For the streaming ecosystem, this means prime contractors must now implement rigorous flow-down clauses, as the DOJ has demonstrated a willingness to pursue subcontractors directly for DFARS violations. The inclusion of AI-specific usage restrictions reflects a growing industry-wide necessity to ringfence proprietary data from generative model training. Industry professionals should monitor the Reform Task Force report due in September 2026, which will likely determine the final implementation timeline for CMMC Phase 2 requirements.

The DOJ's aggressive posture on cybersecurity misrepresentation reflects a broader enforcement wave across federal contracting. In fiscal year 2025, the department resolved nine False Claims Act cases involving cybersecurity compliance failures for a combined $52 million, marking the largest single-year total since the Cybersecurity Fraud Initiative launched in 2021. The initiative, announced by Deputy Attorney General Lisa Monaco, specifically targets contractors who falsely certify adherence to NIST SP 800-171 and FedRAMP requirements. Several of these cases originated from whistleblower complaints under the qui tam provisions, a mechanism that incentivizes employees at firms like DXC and MORSE Corp to report internal compliance gaps. The DOJ's Civil Division has signaled that future enforcement will extend to AI-specific data handling commitments, a category that did not exist when the initiative began.

Regulatory frameworks referenced in these contracts are themselves undergoing significant revision. CMMC 2.0's final rule was published in the Federal Register in December 2024, establishing a phased implementation timeline that requires Defense Industrial Base contractors to achieve third-party assessment at Level 2 before contract award. The rule affects approximately 80,000 contractors and 20,000 subcontractors in the defense supply chain. Meanwhile, FedRAMP authorized 14 new cloud service providers in the first half of 2025, expanding the pool of compliant infrastructure options available to government agencies. For streaming and media companies providing services to federal clients, the convergence of CMMC Phase 2 deadlines and DOJ enforcement creates a compressed compliance window. Schwabe experts urge AI governance integration with existing privacy compliance frameworks, noting that data residency clauses and AI training restrictions are becoming standard contract terms rather than optional addenda.

Technical compliance standards at the center of these enforcement actions are evolving in parallel. NIST published revision 2 of SP 800-171 in February 2024, adding 32 new security requirements and reorganizing control families to align more closely with CMMC assessment objectives. The revision introduced explicit requirements for supply chain risk management and configuration management that directly affect how IT vendors handle subcontractor data flows. For companies like Centene and Illumina, which maintain federal contracts through healthcare and research programs, the updated standard requires documented evidence of compliance at the system level rather than organizational attestation. that will determine whether CMMC Phase 2 requirements become mandatory contract conditions or remain advisory, a decision that will directly shape vendor investment priorities across the streaming and IT infrastructure sectors.