“Penn State told the government in late 2020 that it hadn’t implemented all the requirements”
Penn State held 15 Pentagon and NASA contracts that required NIST SP 800-171 controls and did not meet them. The government says it also swapped compliant Box for Microsoft OneDrive, apparently to save money. $1.25 million settles it, with $250k to Matthew Decker, the former CIO who blew the whistle. The cheaper cloud cost $1.25 million.