Overview
Overview and Background
On November 3, the Department of Justice (DOJ) announced its largest False Claims Act (FCA) cybersecurity settlement under its Civil Cybersecurity Fraud Initiative to date.
Defense and aerospace affiliate companies ILC Dover LP and ILC Astrospace LLC (collectively, ILC) agreed to pay $13 million to resolve allegations that they knowingly violated the FCA by submitting claims while failing to meet certain contractual cybersecurity requirements mandated by the Department of the Army, Missile Defense Agency, and National Aeronautics and Space Administration. The settlement followed a whistleblower's filing of a qui tam action in federal court raising similar allegations. The alleged deficiencies involved the use of noncompliant cloud services, lack of compliance documentation, failure to implement required security controls, omission of plans of action and milestones, and failure to conduct and submit required cyber assessments.
In 2021, the DOJ announced its Civil Cybersecurity Fraud Initiative, which has increasingly brought enforcement actions against contractors who allegedly fail to meet federal cybersecurity requirements. This settlement demonstrates that the DOJ is continuing to target companies that allegedly fail to meet cybersecurity requirements mandated by federal contracts, and that the DOJ will likely continue to use the FCA as a tool to uncover fraud, recover government losses, and deter future misconduct.
The settlement also underscores that contractual cybersecurity compliance requires more than simply deploying security tools. Contractors need accurate documentation, reliable assessment processes, and oversight of third parties handling sensitive information.
Alleged Deficiencies
1) Noncompliant Cloud Services
The DOJ alleged that ILC stored controlled unclassified information (CUI) with a third-party cloud service provider without ensuring the service provider was compliant with security standards equivalent to Federal Risk and Authorization Management Program (FedRAMP) Moderate or applicable DoD requirements for incident reporting, malware handling, evidence preservation, forensic analysis, and cyber incident damage assessments.
2) Lack of Required Security Documentation
ILC allegedly failed to develop, document, and regularly update its system security plans (SSPs) for each covered information system, as required by its DoD and NASA contracts. An SSP describes a covered system's boundaries, operating environment, and connections to other systems, and documents how applicable security requirements are implemented, providing a foundation for assessing compliance. Accurate descriptions of system boundaries, operating environments, controls, and connections help identify gaps and ensure that assessments account for the systems and information requiring protection.
3) Failure to Implement Required Security Controls
The DOJ alleged that ILC failed to fully implement security controls required under its DoD and NASA contracts, including controls identified in NIST SP 800-171 and NIST SP 800-53. Defense contractors that process, store, or transmit CUI on covered contractor information systems are generally required to implement NIST SP 800-171 pursuant to DFARS 252.204-7012. By contrast, NIST SP 800-53 requirements may apply to contractors operating federal information systems on behalf of an agency or where expressly incorporated into contractual obligations. These NIST controls establish technical, administrative, and operational safeguards, including access restrictions, user authentication, secure system configuration, incident response, and vulnerability remediation. They are designed to protect information and systems against unauthorized access, disclosure, modification, and disruption.
4) Omission of Plans of Action and Milestones
ILC allegedly failed to develop and implement plans of action and milestones (POA&Ms) to address identified security deficiencies and mitigate or eliminate vulnerabilities in its systems. Both NIST SP 800-171 and NIST SP 800-53 frameworks require organizations to periodically assess security controls and develop and implement plans of action to correct identified deficiencies and reduce or eliminate vulnerabilities. POA&Ms serve as a roadmap for remediation by identifying outstanding security gaps, documenting corrective actions, setting completion timelines, and assigning responsibilities for implementation. Failure to maintain these plans may constitute noncompliance with applicable contractual cybersecurity requirements, even where the underlying vulnerabilities have been remediated.
5) Failure to Submit Cybersecurity Assessments
ILC Astrospace also allegedly failed to submit any current assessment of its implementation of NIST SP 800-171 controls to DoD for almost four years, which was likely required by DFARS 252.204-7019 and DFARS 252.204-7020 at the time of solicitation and under its contract. At the same time, ILC Dover also allegedly lacked a current assessment meeting DoD's requirements. The assessment was required to be current, based on a review of the relevant SSP, and conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology.
The Terms of the Settlement
ILC's $13 million settlement designated half of that amount as restitution, suggesting that the settlement represents a doubling of damages, which is typically the starting point of settlement negotiations. The whistleblower will receive $2.35 million—approximately 18.1% of the settlement principal—and ILC will separately pay the whistleblower's attorney $288,000 to cover reasonable expenses, attorneys' fees, and other costs permitted under the law. The resolution does not impose any monitorship or other reporting responsibilities.
ILC must also pay the whistleblower $180,000 to resolve separate claims outside the settlement's defined “Covered Conduct.” The terms of the public settlement do not identify what “Non-Covered Conduct” entails, but the $180,000 payment is separate from both the government's recovery and the whistleblower's statutory share. Notably, the settlement imposes no additional settlement-specific monitorship, remediation, or reporting obligations, limiting the resolution's ongoing compliance burden solely to its monetary terms.
What Contractors Should Do Now
The Defense Industrial Base and other federal contractors should consider the following steps in order to avoid contractual noncompliance and ensuing FCA scrutiny:
- Map requirements to contracts and systems. Identify the cybersecurity clauses, control frameworks, assessment requirements, and third-party obligations applicable to each contract and covered environment. Account for differences among agencies and contractual requirements (e.g., DoD vs. NASA).
- Validate cloud-provider arrangements. Confirm where covered information is stored and processed, whether the relevant service satisfies applicable security requirements, and whether agreements address required reporting, preservation, and forensic cooperation, as well as whether they dictate who is responsible for certifying compliance. Perform due diligence and do not rely solely on broad vendor assurances.
- Keep system security plans current. Ensure that SSPs and other policies and procedures accurately reflect system boundaries, operating environments, connections, and implemented controls. Establish a process for updates when systems or services change and confirm contractual requirements that mandate updates to the government.
- Verify implementation and remediation progress. Compare documented compliance with actual technical configurations and supporting evidence. Where remediation plans are permitted, assign owners, set milestones, and track progress without treating those plans as a substitute for compliance.
- Reconcile assessments with supporting records. Verify that required assessments are current, follow the applicable methodology, and correspond to the relevant systems and security plans. Address discrepancies through the appropriate contractual or regulatory process.
- Escalate concerns affecting government-facing representations. Coordinate cybersecurity, contracts, finance, and legal functions when deficiencies could affect certifications, assessments, or payment requests. Preserve relevant records and evaluate any applicable disclosure obligations with counsel.
The central lesson is that cybersecurity compliance is a continuing contractual responsibility. Contractors are better positioned to manage enforcement risk when their technical implementation, compliance records, vendor arrangements, and government-facing representations remain aligned. This will assist in ensuring representations made to government entities, whether express or implied, demonstrate compliance with the applicable requirements.
Key Takeaways
1) The DOJ is continuing to pursue allegations that contractors are failing to meet contractual cybersecurity requirements under its Civil Cybersecurity Fraud Program, with settlement amounts now exceeding $10 million. Contractors should remain aware of the DOJ's continued focus in this area, implement the necessary security controls, and comply with contractual requirements.
2) The DOJ settlement puts both technical implementation and compliance records in focus. Contractors should ensure that internal compliance documentation is accurate, that government-facing cyber assessments are updated and provided to the relevant government entity as required, and accurately reflect the systems used to perform federal contracts. Consider performing a counsel-directed mock cybersecurity audit under attorney-client privilege to identify and remediate compliance gaps and to ensure assessments are up to date and accurate.
3) The DOJ's allegations highlight the importance of examining both a cloud service provider's security documentation and the contractual arrangements supporting its use. This scrutiny will remain important as FedRAMP moves toward full implementation of the FedRAMP 20x certification program in 2027. Under DoD's guidance on FedRAMP Moderate equivalency, none of the new FedRAMP 20x certification classes, by itself, establishes Moderate equivalency. Nor does the 20x certification process alone produce the documentation defense contractors need to validate FedRAMP Moderate equivalency.
1 Press Release, Defense and Aerospace Contractors ILC Dover and ILC Astrospace Agree to Pay $13M to Resolve Cybersecurity Fraud Allegations, Office of Public Affairs (Nov. 3, 2026) https://www.justice.gov/opa/pr/defense-and-aerospace-contractors-ilc-dover-and-ilc-astrospace-agree-pay-13m-resolve
