Inflated SPRS score = False Claims Act exposure
DoJ Civil Cyber-Fraud Initiative actively prosecutes contractors who self-report inflated NIST 800-171 SPRS scores. Every control marked 'implemented' must have artifacts — policy + procedure + screenshots + ticket IDs. Aerojet, Verizon, Penn State all settled.
ESP / MSP / cloud vendors handling CUI need their own CMMC L2
Per CMMC final rule (32 CFR 170), External Service Providers handling CUI must themselves be CMMC L2 certified. Many MSPs are scrambling — primes must verify before flow-down.
FedRAMP-equivalent ≠ FedRAMP
DFARS 252.204-7012(b)(2)(ii)(D) requires CSP storing CUI to be FedRAMP Moderate OR equivalent. 'Equivalent' is a high bar — the DoD Memo (Dec 2023) requires a body of evidence equivalent to a FedRAMP 3PAO assessment.
ITAR registration ≠ ITAR compliance
DDTC registration is just the entry ticket. You also need TCPs (Technology Control Plans), §126.18 dual-national procedures, §124.1 export agreements for foreign-person access, and physical/logical access controls preventing unauthorized exports.