The Cybersecurity Whistleblower Guide
If you are a security professional who knows your employer certified compliance it does not have, the practical questions are what evidence you may lawfully keep, how a clearance changes the process, and how quickly you need to act. The first-to-file rule means only the first relator recovers.
Start with what you already have lawfully
The strongest cybersecurity cases are built from documents the relator was authorized to see as part of their job. A gap assessment you performed, a system security plan you maintained, an email chain where you raised the issue, a POA&M you drafted.
You do not need to gather anything new, and you should not. Accessing systems or documents outside your normal authorization can create separate legal problems for you and can taint the case. What you remember, described precisely, is admissible and useful.
What makes cyber evidence persuasive
Government investigators in these matters are technical. The details that would matter to an auditor are the details that matter here.
- The specific contract or solicitation number carrying the DFARS, CMMC, or FedRAMP obligation
- The control identifiers that were not implemented, by NIST 800-171 number
- The SPRS score posted, the date, and the assessment that produced the real number
- Who signed the certification and what they were told before signing
- Any internal escalation, and the response to it
- Whether the contract was awarded, renewed, or extended after the certification
Clearances change the mechanics, not the right
Holding a clearance does not prevent you from being a whistleblower. It changes how the disclosure is structured. Classified information is handled through channels built for it, and your complaint and disclosure statement are drafted so they do not contain anything you are not authorized to share.
Raise the clearance at the first conversation rather than later. It shapes drafting from the beginning, and retrofitting a complaint is harder than writing it correctly.
Your NDA does not stop you
Confidentiality agreements cannot lawfully prevent an employee from reporting suspected violations of law to the government. Provisions that purport to do so are unenforceable, and the Securities and Exchange Commission has penalized employers for using them.
This comes up constantly in cyber matters, because security staff typically sign broader confidentiality terms than other employees. The agreement restricts what you may disclose publicly and to competitors. It does not restrict what you may disclose to the Department of Justice.
Timing and the first-to-file rule
Only the first relator to file on a given fraud can recover. In cybersecurity that risk is real, because a compliance failure is usually visible to a whole team rather than one person, and any of them could file.
The practical implication is that the assessment conversation should happen sooner rather than later. It costs nothing and it establishes whether you are looking at a case.
What happens after you file
The case is filed under seal and served on the Department of Justice, not on your employer. The government investigates, often with the relevant inspector general and sometimes with the Defense Criminal Investigative Service. That takes one to three years.
You keep working during that period. Your employer is not told. If you are retaliated against for something else in the meantime, that is a separate claim under section 3730(h) carrying reinstatement, double back pay, and attorney fees.
Frequently asked questions
Should I report internally first?
In cybersecurity this is a harder call than usual, because internal reporting is often part of your job. Raising a control gap through normal channels is expected and does not waive anything. What changes the calculus is reporting that the certification itself is false, which alerts the company. Speak to counsel before that step.
Can I take copies of the assessment I wrote?
Discuss it with counsel before you do anything. The general rule is that documents you accessed lawfully in the course of your work stand differently from documents you collected after deciding to file. Courts have not treated these identically, and the safe path is to ask first.
What if I already left the company?
Former employees are eligible relators and frequently make the strongest ones, because there is no ongoing retaliation risk. The six-year limitations period runs from the violation, so leaving does not close the window.
Is my case worth bringing if the contract was small?
Possibly, because damages are trebled and each false claim carries its own penalty. A modest contract billed monthly over several years generates a large number of claims. Size is worth assessing rather than assuming.
The attorneys who handle these cases
Related reading
Talk to a whistleblower attorney before you report
A conversation costs nothing and is confidential. We will tell you honestly whether what you have describes a case, and what the first-to-file rule means for your timing.