Cybersecurity Assessment Credential Authority Failure Through SPRS Score Submitted for a Fabricated IT Environment Rather Than the Actual Assessed System — Georgia Tech Research Corporation, 2025

DoD contractors handling controlled unclassified information are required to implement the 110 security controls specified in NIST SP 800-171. Beginning in late 2020, contractors were required to self-assess their compliance and submit the resulting score to the Supplier Performance Risk System — a DoD database that contracting officers consult when evaluating contract awards. The SPRS score is a condition of contract award. It certifies that the contractor's IT environment meets the required security controls. The relying party — DoD — evaluates the credential, not the environment.

Georgia Tech Research Corporation conducted research under Air Force and DARPA contracts at the Astrolavos Lab — a facility conducting cybersecurity research, including research intended to identify cyber threat actors and limit cyberattacks. The Lab did not develop a System Security Plan until 2020, three years after contracting began. It did not run required antivirus software. When GTRC was required to submit an SPRS score, the GRC team was directed to produce a score for a campus-wide virtual IT environment rather than the Astrolavos Lab. The score submitted was 98 out of 110 — a high-compliance result for an environment that did not exist.

Two former members of Georgia Tech's Cybersecurity Team — Christopher Craig and Kyle Koza — filed a qui tam complaint in 2022. DOJ intervened in 2024, filing a complaint-in-intervention alleging three failures: no antivirus software at the Astrolavos Lab, no System Security Plan for the first three years of contracting, and a false SPRS score submitted for a fabricated virtual environment. GTRC filed a 63-page motion to dismiss in October 2024, arguing the research did not involve controlled unclassified information and challenging the government's ability to establish falsity and materiality. The case was referred to mediation and settled on September 30, 2025 for $875,000 — the fourteenth settlement under DOJ's Civil Cyber-Fraud Initiative.

The settlement amount is significantly lower than other Civil Cyber-Fraud Initiative resolutions, reflecting both the relatively modest contract value at issue and the genuine litigation risk the government faced on materiality. No data breach was alleged or occurred. The FCA violation arose from the false representation in the credential — the SPRS score — not from any demonstrated harm to the information the credential was designed to protect.

The SPRS score is a self-certification credential. The contractor assesses its own environment against the NIST SP 800-171 controls, produces a score, and submits it to a DoD database. The relying party — the contracting officer — consults the database at contract award. The credential certifies the compliance condition of the contractor's IT environment. The contracting officer does not evaluate the environment. The credential resolves that question in the contractor's favor.

The structural failure in this case is not that the score was inaccurate — it is that the score certified a compliance condition for an environment that was not the environment under contract. The credential's evidentiary boundary did not correspond to the system the credential was required to certify. GTRC's GRC team produced a score for a fabricated virtual campus-wide system. The Astrolavos Lab — the actual research environment, the system handling the information the credential was designed to protect — was not assessed. It had no System Security Plan. It did not run antivirus software. The score of 98 out of 110 certified compliance for a system that witnesses described as "fictitious." DoD awarded contracts on that certification.

The self-certification architecture is the enabling condition. When the entity submitting the credential also determines what the credential certifies, the correspondence between the credential and the environment it is required to represent is not evaluable at the point of reliance. The contracting officer receives the score. The score resolves the compliance question. The environment that produced the score is not the environment the score was required to assess. The relying party evaluated a credential whose evidentiary boundary did not correspond to the system under contract.

The $875,000 settlement resolved the FCA allegations without an admission of wrongdoing. The Civil Cyber-Fraud Initiative continues to pursue cybersecurity self-certification failures across defense contractors. The CMMC program — now finalized and beginning to appear in DoD contracts — will require third-party assessment and executive sign-off on SPRS scores, replacing the self-certification architecture that produced this case. The structural correction CMMC imposes is the separation of the assessment function from the entity with the financial interest in the assessment's outcome — the same independence condition the self-certification model did not require.

The remediation is architectural. CMMC does not require the credential to encode the evidentiary boundary of the assessment in a form evaluable at the point of contract award. It requires that a third party perform the assessment. The credential still certifies a compliance condition whose correspondence to the actual environment is not verifiable from the credential at the point of reliance. The assessment is separated from the contractor. The credential remains a self-contained assertion.

• The SPRS score is a self-certification compliance credential — the contractor assesses its own environment, produces a score, and submits it to a DoD database consulted at contract award; the relying party evaluates the credential, not the environment; the credential resolves the compliance question in the contractor's favor at the point of reliance
• GTRC submitted a score of 98 out of 110 for a fabricated virtual campus-wide IT environment; the Astrolavos Lab — the actual research environment under contract — had no System Security Plan for the first three years of contracting and did not run required antivirus software; witnesses described the submission as based on a "kind of fictitious environment"; the credential's evidentiary boundary did not correspond to the system the credential was required to certify
• The organizational context documented in the complaint is structurally significant: high-profile researchers were permitted to ignore cybersecurity requirements because leadership did not want to discourage participation in lucrative federal contracts; the compliance credential was subordinated to contract revenue; the self-certification architecture provided no mechanism by which the relying party could evaluate whether the compliance condition was present at the point of award
• No data breach was alleged or required for FCA liability; the violation arose from the false representation in the credential — the SPRS score — not from demonstrated harm; the credential authorized continued contract award; the condition it certified was not the condition of the environment under contract
• The CMMC remediation — third-party assessment and executive sign-off replacing self-certification — separates the assessment function from the entity with the financial interest in the outcome; it does not require the credential to encode the evidentiary boundary of the assessment in a form evaluable at the point of contract award; the correspondence condition is assessed independently but not encoded in the credential surface available to the relying party at reliance
• A cybersecurity compliance credential that encodes the evidentiary boundary of the assessment — the specific system assessed, the controls evaluated, the date of assessment, and the correspondence between the assessed environment and the environment under contract — in a form evaluable at the point of contract award makes the compliance condition demonstrable without requiring the relying party to trust the submitting entity or the assessor; a fabricated environment fails at the point of credential generation, before it reaches the relying party