Photo of Erik Dullea

Erik Dullea

As head of Husch Blackwell’s Cybersecurity practice group, Erik assists clients in all aspects of cybersecurity and information security compliance and data breach response. Erik previously served as the acting deputy associate general counsel for the National Security Agency’s cybersecurity practice group before returning to the firm in 2023.

Follow:Read more about Erik DulleaErik's Linkedin Profile
Cyber security and protection of private information and data concept. Locks on blue integrated circuit. Firewall from hacker attack.

This summer, defense contractors have received two very different signals about federal cybersecurity compliance. On one front, the Department of Justice (DOJ) is continuing to pursue False Claims Act (FCA) liability for contractors that misrepresent their cybersecurity posture—now with two settlements in quick succession targeting noncompliance with NIST SP 800-171 requirements. On the other, the newly renamed Department of War suspended the next phase of the Cybersecurity Maturity Model Certification (CMMC) program. Neither development changes the baseline obligations contractors already have, but together they illustrate how fluid—and consequential—this space remains.

Cyber security and protection of private information and data concept. Locks on blue integrated circuit. Firewall from hacker attack.

Recent Settlements

On July 31, 2025, the DOJ announced that a California-based defense contractor, and its private equity owner Gallant Capital Partners agreed to pay $1.75 million to resolve allegations that they knowingly failed to comply with cybersecurity requirements in a contract with the Department of the Air Force. The government acknowledged that the companies…