Michael J. Bannach: The CMMC Pause Did Not Pause the False Claims Act

On September 1, 2026, the Justice Department announced that Honeywell Aerospace would pay $2,042,518 to resolve allegations that it failed to implement required cybersecurity controls on a Defense Department contract between April 2020 and December 2023. The relator who brought the case will receive $375,823. The announcement came seven weeks after the Pentagon suspended Phase II of the Cybersecurity Maturity Model Certification (CMMC) program.

For Michael J. Bannach, President and CEO of Stealth Technology Group (STG), a Cyber AB Registered Practitioner Organization, the timing tells defense contractors what they need to know. “A lot of companies heard ‘CMMC is paused’ and relaxed,” said Bannach, a CISSP with more than 25 years in enterprise IT and cybersecurity. “The False Claims Act never cared about CMMC deadlines. It cares about whether what you told the government was true.”

A Suspended Deadline, an Unchanged Obligation

The July 13 suspension ordered Level 2 (C3PAO) and Level 3 (DIBCAC) certification requirements removed from solicitations and existing contracts, and held pending and future CMMC milestones in abeyance while the Department reviews the program. It left the foundation in place. DFARS 252.204-7012 still requires contractors that handle covered defense information to implement the 110 security requirements of NIST SP 800-171 Revision 2 and to report cyber incidents within 72 hours. Level 1 and Level 2 self-assessments remain in solicitations, and contractors still post their scores in the government’s Supplier Performance Risk System. During the review, the Pentagon has said it will enforce NIST SP 800-171 through self-assessments and select government-led assessments.

Clause numbers have shifted under this year’s acquisition-regulation overhaul, but the representation has not. A contractor that posts a score is still telling the government something the government is entitled to rely on.

What the Settlements Have in Common

The Justice Department launched its Civil Cyber-Fraud Initiative on October 6, 2021. The cases it has resolved since follow a pattern Bannach says he sees in readiness work every month: a number in a government system that does not match the network behind it.

MORSECORP agreed in March 2025 to pay $4.6 million to resolve allegations that it failed to meet cybersecurity requirements in its Defense Department contracts. According to the Justice Department, the company posted a self-assessment score of 104 in January 2021, a third-party cybersecurity consultant told the company in July 2022 that its score was actually negative 142, and the company did not update its score until June 2023, after receiving a subpoena. The relator received $851,000. In June 2026, LOGZONE, an Alabama defense contractor, agreed to pay $507,144 to resolve allegations tied to its cybersecurity representations, after a government assessment scored its implementation at negative 170 on a scale where the maximum is 110. Georgia Tech Research Corporation paid $875,000 in September 2025 to resolve allegations that included submitting a score for what the government called a “fictitious” environment, and Raytheon and Nightwing paid $8.4 million in May 2025 to resolve allegations involving 29 Defense Department contracts and subcontracts.

The financial math is unforgiving. The False Claims Act provides for treble damages plus civil penalties that currently range from $14,308 to $28,619 per claim, and relators can receive 15 to 30 percent of what the government recovers.

An inaccurate score is not automatically fraud. Liability generally turns on what the company knew and whether the misstatement mattered to the government’s decisions. That is exactly why the record behind a score matters as much as the number itself.

“The people who file these cases are often the people who know where the gaps are: an IT manager, a compliance lead, a consultant,” Bannach said. “If your score and your reality don’t match, someone inside the company probably knows it.”

Why the Pause Raises the Stakes on Self-Assessment

With certification requirements out of solicitations and contracts, the self-assessment and the annual affirmation carry more weight, not less. For most suppliers, no independent assessor will stand between the score and the government any time soon. The affirming official is a senior executive, and the affirmation is a statement the government can hold the company to.

“The pause puts the full weight on your own signature,” Bannach said. “That affirmation is a legal representation, and it deserves the same care as a financial certification.”

Building a Record That Holds Up

Bannach’s advice to executives and general counsel is practical. Score against the CMMC scoring methodology in 32 CFR 170.24 exactly as written, and tie every requirement marked as met to evidence that someone other than its author has reviewed. Keep the System Security Plan and the plan of action and milestones current and dated, because an assessor and a litigator will read the same documents. Validate independently; a voluntary C3PAO assessment, which remains available during the pause, is the strongest evidence that a score is real.

Fix a wrong score quickly. The False Claims Act allows courts to reduce damages to as little as double for companies that self-disclose within 30 days and meet the statute’s other conditions, and the Justice Department has credited self-disclosure in cyber cases, including a $1.75 million settlement in July 2025 with Aero Turbine and Gallant Capital Partners, the private equity firm that held a controlling stake in the company. Bring counsel in early, so privilege and remediation planning move together.

“Nobody I work with wants to be a test case,” Bannach said. “The contractors who sleep well are the ones who can hand their lawyer, their prime or an assessor the same evidence on the same day, and have it all agree.”

STG helps defense suppliers build that record, starting with a CMMC readiness assessment that scores the environment the way an assessor would.

Michael J. Bannach is President and CEO of Stealth Technology Group (STG), one accountable partner for IT, cybersecurity, compliance and AI for regulated mid-market companies and defense suppliers. STG is a Cyber AB Registered Practitioner Organization with teams serving Tampa, Sarasota, Boston and Greater Philadelphia. A CISSP with more than 25 years in enterprise IT and cybersecurity, Bannach also holds CCNP Enterprise and CCNP Collaboration certifications, a certificate in AI products and services from MIT, and an Executive MBA from Saint Joseph’s University. Learn more at michaelbannach.com and stealthtech365.com.