{"id":34185,"date":"2026-07-31T12:56:57","date_gmt":"2026-07-31T16:56:57","guid":{"rendered":"https:\/\/www.oxebridge.com\/emma\/?p=34185"},"modified":"2026-07-31T13:29:47","modified_gmt":"2026-07-31T17:29:47","slug":"ig-complaint-filed-against-stacy-bostjanick-alleging-multiple-felonies","status":"publish","type":"post","link":"https:\/\/www.oxebridge.com\/emma\/ig-complaint-filed-against-stacy-bostjanick-alleging-multiple-felonies\/","title":{"rendered":"IG Complaint Filed Against Stacy Bostjanick Alleging Multiple Felonies"},"content":{"rendered":"

Oxebridge has filed a formal whistleblower complaint with the Dept. of War Inspector General’s office (DODIG) alleging multiple felonies by former “CMMC architect<\/em>” Stacy Bostjanick.<\/p>\n

The complaint centers on Bostjanick’s sudden resignation from the DoD as head of the CMMC Program Management Office and immediate hire by CMMC C3PAO, Cybersec Investments. It also alleges that Bostjanick used her role as PMO head to block CMMC-related complaints that would have impacted companies such as Cybersec, and for immediately performing lobbying for CMMC while not registered under the Lobbying Disclosure Act (LDA).<\/p>\n

It is important to emphasize that the complaint highlights allegations<\/strong><\/em>, and that it is up to the Inspector General and the Department of Justice to determine if felonies were actually committed.<\/p>\n

History of Obstruction and Suppression<\/strong><\/span><\/p>\n

Bostjanick led the CMMC program for the DoD alongside Katie Arrington, and appeared at multiple events publicizing the program alongside various CMMC service providers. At least one event included Cybersec Investments, in which she gave a joint speech on CMMC alongside Cybersec’s Fernando Machado and assessor Tara Lemieux. She also consistently promoted the Cyber AB, which was created by the DoD to oversee the CMMC program.<\/p>\n

At the same time, Bostjanick personally blocked or ignored formal complaints filed with her office against the Cyber AB and various CMMC service providers, including C3PAOs. Between the period of March 2021 through March of 2025, Oxebridge filed nearly a dozen complaints against CMMC actors; Bostjanick took no action on any of them. Sometime in 2023, Bostjanick stopped replying to the complaints entirely. Some of these included serious matters such as a C3PAO issuing a forged CMMC assessment report that had been photoshopped with the DoD logo to appear as if it were an official government document.<\/p>\n

Bostjanick went so far as to overrule a formal FOIA request to release the DoD’s contract with the Cyber AB, going so far as to deny it even to the DODIG itself when presented with a FOIA. Federal contracts are required to be publicly available unless they include classified information, which the Cyber AB’s contract does not. In response to the FOIA, the DODIG reported that the documents produced by Bostjanick’s \u201cdo not consist of the contract described in your request<\/em>.\u201d Bostjanick then wrote in an email to Oxebridge that she decides what is “of benefit<\/em>” to the American people, appearing to ignore FOIA law entirely.<\/p>\n

The relationship with Cybersec is problematic in that not only did Bostjanick help promote the company while acting in her official DoD role, but she also became employed by them in mere hours after announcing her retirement, suggesting she may have negotiated the employment while still acting in her government role. Just two months later, Cybersec hired her son, Mark Bostjanick Jr., as a “Financial Analyst.<\/em>”<\/p>\n

The moves made by Bostjanick while at the DoD now appear to benefit Cybersec. For example, Cybersec later became “accredited<\/em>” as a C3PAO to ISO 17020. However, the Cyber AB does not hold ISO 17011 accreditation itself, so it is not authorized to accredit any organization. Instead, it now appears that the Cyber AB outsourced ISO 17020 accreditation work to the US accreditation body ANAB. Because Bostjanick blocked the release of the Cyber AB’s contract, it is unknown if the use of ANAB by the Cyber AB violates that contract. Therefore, we cannot know if Cybersec’s “accreditation<\/em>” is valid or not.<\/p>\n

ANAB has no record of Cybersec on its public registry of ISO 17020 accredited inspection bodies.<\/p>\n

Furthermore, Cybersec is now using Bostjanick to lobby the Senate Armed Services Committee on its behalf; however, neither Cybersec Investments nor Bostjanick herself appear in entries in the official LDA registry of registered lobbyists.<\/p>\n

Alleged Felony Violations<\/strong><\/span><\/p>\n

The initial filing with DODIG alleged multiple felony violations by Bostjanick. Specifically, these include:<\/p>\n