The major problem from the article is it appears the lab just lied about complying with the government’s requirements. Like they said the lab’s network firewal

The major problem from the article is it appears the lab just lied about complying with the government’s requirements. Like they said the lab’s network firewall provided “anti-virus” capabilities, but the University said no such capability exists and that several lab computers are laptops used outside of the University network. Additionally they lied about having logging and monitoring capabilities. If you have a list of requirements to get a contract and say you have mitigations in place for risks identified for not meeting all the requirements and those mitigations turn out to not exist at all, how can government be sure they are actually doing things securely?