October 23, 2024 at 07:33PM
Pennsylvania State University will pay $1.25 million to settle Justice Department claims of misleading cybersecurity compliance. Allegations stem from a whistleblower lawsuit, stating Penn State failed to implement required NIST security standards for sensitive data in contracts with the Pentagon and NASA. The settlement does not imply guilt.
**Meeting Takeaways: Pennsylvania State University Settlement with Justice Department**
1. **Settlement Amount**: Pennsylvania State University (PSU) has agreed to pay $1.25 million to the Justice Department (DoJ) to settle allegations related to cybersecurity compliance.
2. **Background of the Case**: The settlement arises from a court case initiated by Matthew Decker, a former PSU CIO, who alleged that the university misrepresented its adherence to cybersecurity requirements while failing to secure sensitive data adequately.
3. **NIST Compliance Issues**: The DoJ claims PSU did not comply with NIST SP 800-171 standards, which are essential for storing controlled unclassified information (CUI) under contracts with the Department of Defense (DoD) and NASA.
4. **Allegations of Misleading Information**: PSU is accused of failing to implement necessary security measures and incorrectly reporting its progress to the government regarding these requirements.
5. **Use of Hosting Services**: The university switched from a government-compliant cloud service (Box) to OneDrive, which allegedly does not meet NIST’s CUI security criteria, purportedly for cost savings.
6. **Whistleblower Compensation**: Matthew Decker, as the whistleblower, is set to receive $250,000 from the settlement.
7. **University’s Stance**: PSU maintains that the settlement does not imply admission of guilt and emphasizes its commitment to cybersecurity compliance, stating that no actual harm to sensitive information occurred.
8. **Desire for Resolution**: Penn State aims to avoid further litigation and to address any concerns from its government sponsors regarding the matter.
These key points summarize the significant aspects of the settlement and the underlying allegations while reflecting PSU’s position on the issue.