Defense contractor to pay $4.6 million over third-party provider’s security weakness

A Cambridge-based defense contractor, MORSE Corp, agreed to a $4.6 million settlement with the U.S. Department of Justice for misrepresenting compliance with federal cybersecurity standards, including using a third-party email host without required NIST controls and lacking adequate system security plans. A 2021 self-assessment overstated its score (104) compared to a 2022 auditor’s -142, with 78% noncompliance, and the company delayed revising its score until after a subpoena. The case reflects escalating DOJ False Claims Act enforcement on cybersecurity, with recent multimillion-dollar settlements involving other federal contractors and academic institutions.