A $13 million False Claims Act settlement over DoD contractor cybersecurity compliance failures shows that attestations made on federal contracts are enforced with real money.
Federal News Network reported the settlement, in which ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million to resolve allegations that they knowingly misrepresented compliance with cybersecurity requirements in contracts with the Army, the Missile Defense Agency and NASA. The Justice Department announced the agreement, and the underlying case began as a whistleblower lawsuit. If your company holds defense, aerospace or other federal contracts that carry cybersecurity obligations, this settlement is worth your attention: it is the largest False Claims Act cybersecurity settlement to date, and it shows how internal security documentation can become evidence in a fraud case.
Key Takeaways
- ILC Dover LP and ILC Astrospace LLC will pay $13 million to settle allegations that they submitted false and fraudulent claims for payment while failing to meet contractual cybersecurity requirements from January 2018 to October 2024, according to the Justice Department. Federal News Network has the full report.
- The settlement resolves allegations only. "There has been no determination of liability," the Justice Department said in a statement.
- The allegations include storing controlled unclassified information with an external cloud service provider without ensuring the provider met FedRAMP Moderate baseline requirements, incomplete implementation of NIST SP 800-171 and NIST SP 800-53 controls, missing system security plans, and missing plans of action and milestones.
- The case began as a whistleblower suit filed by Philip Root, ILC's former Director of Cybersecurity, who will receive a $2.35 million share of the settlement. The contractor will also pay the whistleblower's attorney $288,000 in expenses and fees.
- This is the largest False Claims Act cybersecurity settlement to date, and it follows earlier settlements under the Justice Department's Civil Cyber-Fraud Initiative, including Raytheon at $8.4 million in May 2025 and Verizon at $4.09 million in 2023.
What happened: the facts in detail
The parties and the alleged conduct
According to the Justice Department, two defense and aerospace contractors, ILC Dover LP and ILC Astrospace LLC, agreed to pay $13 million to settle allegations that for years they knowingly misrepresented compliance with cybersecurity requirements in their contracts with the Army, the Missile Defense Agency and NASA. The Justice Department alleges the companies submitted false and fraudulent claims for payment while failing to meet the cybersecurity requirements those agencies mandated. The alleged conduct spans January 2018 to October 2024.
The Justice Department was explicit that the agreement resolves allegations rather than adjudicated claims. "There has been no determination of liability," the department said in a statement. That distinction matters for any contractor reading this case: a settlement is not a court finding that the conduct occurred, but the payment is real and the enforcement theory behind it is now on the record.
The four specific allegations
The Justice Department's allegations, as reported by Federal News Network, cover four areas:
First, the government alleges that ILC used an external cloud service provider to store controlled unclassified information without ensuring that the cloud provider met Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline requirements and complied with the Defense Federal Acquisition Regulation Supplement's requirements. For contractors, this tracks a familiar obligation: DFARS 252.204-7012 requires contractors to hold cloud providers handling covered defense information to a FedRAMP Moderate baseline. Our DFARS Compliance Services for DoD Contractors overview explains how that clause works in practice.
Second, the company is accused of not fully implementing all cybersecurity controls under National Institute of Standards and Technology Special Publications 800-171 and 800-53. The Justice Department described two categories of missing controls: "controls that, if not implemented, could lead to significant exploitation of the network or exfiltration of controlled defense information and controls that, if not implemented, could have a specific and confined effect on the security of the network and its data." In other words, the alleged gaps ranged from controls whose absence could enable major compromise to controls with narrower effects.
Third, the government alleges that ILC failed to develop, implement and update system security plans for each of its covered information systems, as required by Defense Department and NASA contracts. A system security plan is the foundational document in NIST SP 800-171 compliance: it describes how each system handles controlled unclassified information, which controls are in place, and how they are implemented.
Fourth, the company allegedly did not develop and implement plans of action and milestones, known as POA&Ms, designed to identify and mitigate cybersecurity weaknesses in its systems. Under the CMMC program rules, POA&Ms are permitted only for "not met" requirements within the limits of 32 CFR 170.21, with a 180-day closeout, so a missing or stale POA&M is both a compliance gap and a documentation gap.
How the case came to light
The settlement resolves a whistleblower lawsuit filed under the False Claims Act by Philip Root, ILC's former Director of Cybersecurity, raising similar allegations. Under the statute's qui tam provisions, a private relator can sue on the government's behalf and share in any recovery. Root will receive a $2.35 million share of the settlement amount, and the contractor will also pay the whistleblower's attorney $288,000 to cover expenses and fees.
The identity of the relator is itself a lesson. This was not an outside auditor or a hacker who stumbled onto the gaps. It was the company's own former cybersecurity director. Internal security staff see the system security plans, the POA&Ms and the control gaps firsthand, and this case shows that an insider can carry that knowledge into a federal courtroom.
The government's stated rationale
The settlement focused on the potential security risks created by the companies' alleged cybersecurity deficiencies. "The best response to cyberattacks is to prevent them from happening in the first place. The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States' technical innovation," U.S. Attorney Benjamin Wallace for the District of Delaware said in a statement.
DoD contractor cybersecurity compliance: how the enforcement works and why it matters
The False Claims Act reaches cybersecurity obligations through a simple mechanism. When a contractor submits a claim for payment on a federal contract, the submission carries an implied assertion that the contractor has met the contract's material requirements. If those requirements include cybersecurity controls, and the contractor has not implemented them, the government can allege that claims submitted during the period of noncompliance were false. The damages theory in these cases ties the payment to the noncompliance period, which is why the alleged conduct window here runs from January 2018 to October 2024, a span of more than six years across multiple agencies.
The Justice Department formalized this approach through its Civil Cyber-Fraud Initiative, and the settlement amounts have grown. The fact pattern includes Verizon at $4.09 million in 2023, Penn State at $1.25 million in 2024, Raytheon at $8.4 million in May 2025, and Georgia Tech on September 30, 2025. The ILC Dover agreement, at $13 million, is the largest False Claims Act cybersecurity settlement to date, according to Federal News Network.
Why does this matter technically? Because the obligations at issue are specific and verifiable. NIST SP 800-171 contains 110 controls organized into 14 domains, and DFARS 252.204-7012 requires that level of "adequate security" on every covered contractor information system. DFARS 252.204-7019 requires a current NIST SP 800-171 self-assessment score posted to the Supplier Performance Risk System, where scores range from minus 203 to 110 with controls weighted at 1, 3, or 5 points. A contractor's own score, its system security plans and its POA&Ms are all written records. When a fraud case arrives, those records are the evidence, and the gap between what they say and what the network actually does is the alleged fraud.
The cloud allegation deserves particular attention from contractors who have moved controlled unclassified information to commercial platforms. Under DFARS 252.204-7012, cloud providers holding covered defense information must meet a FedRAMP Moderate baseline. The DoD CIO has clarified in CMMC FAQ guidance that encrypted CUI is still CUI, and encrypted CUI in a cloud still needs FedRAMP Moderate or equivalency. In other words, encryption alone does not substitute for an authorized cloud environment. Contractors who have not verified their provider's authorization status have an open question that predates any assessment.
The enforcement environment is also shifting under the CMMC program. The CMMC Program rule, 32 CFR Part 170, took effect on December 16, 2024, and the acquisition rule in 48 CFR, DFARS 252.204-7021, was published on September 10, 2025 and took effect on November 10, 2025. On July 13, 2026, the DoD CIO suspended the November 10, 2026 Phase II deadline, with Phase I self-assessments remaining in force and later milestones paused until further notice. Contractors should read that pause carefully: it changes assessment timing, not the underlying DFARS obligations, which have been in contracts for years. The ILC Dover allegations cover a period when those DFARS obligations, not CMMC certification, were the operative requirement. Our CMMC Compliance Consultant practice and our CMMC 2.0 Final Rule analysis track how the program's phases affect contractors at different points in the pipeline.
For subcontractors, the exposure flows down. DFARS 252.204-7012 must be flowed down to subcontractors, including for commercial products and services, when performance involves covered defense information. A subcontractor reports its own incidents to DoD and gives the report number to the next higher tier. Our article on CUI Handling for DoD Subcontractors covers the sanctions and flowdown mechanics.
What the evidence does and does not show
The most important limit is stated by the Justice Department itself: there has been no determination of liability. The $13 million payment resolves allegations. No court has found that ILC Dover or ILC Astrospace committed fraud, and the companies did not admit the conduct. Readers should treat the government's description of the alleged failures as allegations, not findings.
Several operational questions are not answered by the reporting. The sources do not say how the alleged control gaps were discovered or measured, beyond the fact that the whistleblower lawsuit raised similar allegations. They do not identify which specific NIST SP 800-171 or SP 800-53 controls were allegedly unimplemented, beyond the government's general description of two categories of controls. They do not say whether any actual breach, intrusion or exfiltration of controlled defense information occurred; the Justice Department framed the settlement around "the potential security risks created by the companies' alleged cybersecurity deficiencies," which is a statement about risk, not about a confirmed incident.
The reporting also does not explain how the $13 million settlement amount was calculated, how the alleged conduct period was established, or what remediation the companies have undertaken. It does not say whether other contractors face similar investigations. And while the article calls this the largest False Claims Act cybersecurity settlement to date, the full universe of such settlements is not enumerated in the sources, so the comparison rests on the reporter's characterization rather than a complete list.
One structural point is well supported, though: the case originated with an insider. Philip Root was ILC's former Director of Cybersecurity, and his lawsuit raised allegations similar to those the Justice Department pursued. The sources do not describe Root's motives or the timeline of his disclosures, and readers should not assume details the reporting does not provide. What the sources do establish is that a company's own security leadership is positioned to know where documented compliance and operational reality diverge, and that the False Claims Act gives such insiders both a legal vehicle and a financial incentive to act on that knowledge.
Finally, the regulatory landscape itself is in motion. The DoD CIO's July 13, 2026 suspension of the Phase II deadline means later CMMC milestones are paused until further notice, while Phase I self-assessments remain in force. Contractors planning certification timelines should verify current milestones rather than relying on older guidance, and should remember that the DFARS clauses at issue in this settlement applied regardless of CMMC's phase schedule. The obligations that grounded the ILC Dover allegations existed in contract language, and contract language is enforced.
Compliance and Risk Implications for Regulated Organizations
The ILC Dover settlement matters because of what it was about, not how much it cost. The Justice Department did not allege that a foreign adversary breached the network. It alleged that for years, from January 2018 to October 2024, the contractors misrepresented compliance with contractual cybersecurity requirements while submitting claims for payment on Army, Missile Defense Agency and NASA contracts. The obligations at issue were the ones defense contractors already carry: storing controlled unclassified information only with a cloud service provider meeting FedRAMP Moderate baseline requirements, implementing the controls of NIST SP 800-171 and NIST SP 800-53, maintaining a system security plan for each covered information system, and keeping a plan of action and milestones that identifies and mitigates weaknesses. None of these are new obligations. The allegation is that the paperwork and the practice diverged.
That is the core risk lesson for any regulated organization. Your compliance attestations are not internal documents. When they accompany claims for payment on a government contract, they are representations the government can treat as material to the claim. A gap between what you certified and what your environment actually looks like is the fact pattern the Justice Department has now pursued repeatedly under its Civil Cyber-Fraud Initiative, with prior settlements including Verizon at $4.09 million in 2023, Penn State at $1.25 million in 2024, Raytheon at $8.4 million in May 2025, and Georgia Tech on September 30, 2025. The ILC Dover agreement, at $13 million, is described by the Justice Department as the largest False Claims Act cybersecurity settlement to date.
It is also worth noting who brought the case. The underlying lawsuit was filed by Philip Root, ILC's former Director of Cybersecurity, under the whistleblower provisions of the False Claims Act. Root will receive a $2.35 million share of the settlement, and the contractor will pay his attorney $288,000 in expenses and fees. Internal security leaders who document unremediated gaps are not a theoretical threat vector. They are the most likely source of a qui tam complaint, because they hold the evidence.
One caution on program status: the CMMC framework itself is in transition. The CMMC Program rule, 32 CFR Part 170, took effect December 16, 2024, and the acquisition rule DFARS 252.204-7021 took effect November 10, 2025. On July 13, 2026, the DoD CIO suspended the November 10, 2026 Phase Two deadline, with Phase One self-assessments remaining in force and later milestones paused until further notice. But the DFARS 252.204-7012 obligation to provide adequate security under NIST SP 800-171 has been in contracts for years, and it was that kind of obligation, not a CMMC certificate, at the center of this settlement. Waiting for regulatory clarity is not a defense when the underlying contractual controls are already enforceable.
What This Means for Regulated Industries
Defense contractors
If you hold DoD contracts, the obligations alleged in this case are your obligations. DFARS 252.204-7012 requires adequate security defined as the 110 controls of NIST SP 800-171 on every covered contractor information system, and DFARS 252.204-7019 requires a current NIST SP 800-171 self-assessment score posted to the Supplier Performance Risk System when an offer is submitted. That SPRS score ranges from minus 203 to 110, with controls weighted at 1, 3, or 5 points. An inflated score is itself a representation to the government. The practical guidance is straightforward: verify that your SPRS score reflects a genuine, current self-assessment, confirm your system security plan matches your actual environment, and confirm your POA&M is live rather than a stale document. If you store CUI with an external cloud provider, confirm it meets the FedRAMP Moderate baseline; the DoD CIO has clarified that encrypted CUI is still CUI, and encrypted CUI in a cloud still needs FedRAMP Moderate or equivalency. For a deeper look at the enforcement mechanics, our DFARS compliance services for DoD contractors page walks through the clause structure.
Subcontractors should pay particular attention. DFARS 252.204-7012 must be flowed down to subcontractors when performance involves covered defense information, and the ILC Dover allegations included using an external cloud service provider without ensuring it met FedRAMP Moderate requirements. Your upstream primes are now acutely aware that their subcontractors' gaps can become their liabilities. Our article on CUI handling for DoD subcontractors covers the flowdown and sanction exposure in detail.
Healthcare
The False Claims Act mechanism in this case is specific to government contracts, so a hospital or medical practice does not face identical exposure. But the structural lesson transfers directly to HIPAA. The HIPAA Security Rule at 45 CFR Part 164 requires a documented risk analysis under 45 CFR 164.308(a)(1)(ii)(A) plus 18 standards across administrative, physical, and technical safeguards. The ILC Dover allegations included failing to develop, implement, and update system security plans and failing to implement controls that could lead to exfiltration of sensitive information. Substitute electronic protected health information for controlled defense information and you have the same fact pattern that drives HHS Office for Civil Rights enforcement, including recent actions such as the $3 million Solara settlement in January 2025 and the April 2026 ransomware sweep totaling $1.165 million. There is no HHS-issued HIPAA certification; documentation aligned to NIST SP 800-66 Rev. 2 and the OCR audit protocol is the accepted approach. Our HIPAA compliance services page explains how we build that documentation against real operating evidence.
Legal
Law firms handling government contracts, or serving as counsel to contractors that do, should read this settlement as a due diligence signal. The whistleblower here was the company's own Director of Cybersecurity. Firms advising defense clients should be asking whether the client's compliance representations in contract submissions are supported by current assessments, and whether internal concerns about unimplemented controls have been escalated and documented. Counsel should also understand that the False Claims Act reaches subcontractors through the flowdown of clauses, so a firm's mid-tier and small business clients carry the same representation risk as the prime. For firms handling sensitive client data generally, the same discipline of documented, current control implementation applies.
Financial services
Financial institutions do not typically hold the DFARS clauses at issue here, but many serve defense contractors as lenders, insurers, or technology vendors, and some participate in the defense industrial base through subcontracting. If your institution receives controlled defense information under a flowed-down clause, the obligations follow the information, and the ILC Dover case shows the government will pursue the party that made the representation. More broadly, the settlement reinforces a principle regulators across financial services apply: a written policy that does not match operations is treated as evidence of a compliance failure, not evidence of compliance. Institutions that outsource to cloud providers should also note the allegation about failing to ensure a cloud provider met FedRAMP Moderate requirements; vendor assurance obligations do not transfer to the vendor.
An Action Plan for This Month
Security and IT leaders at defense contractors can act on this settlement immediately. Here is a practical sequence:
- Pull every active contract and list the cybersecurity clauses in each. Identify which contracts carry DFARS 252.204-7012, DFARS 252.204-7019, or DFARS 252.204-7021, and which agencies are involved. You cannot assess representation risk until you know what you represented and to whom.
- Compare your SPRS score against a fresh self-assessment. If the score in SPRS was calculated years ago or reflects an optimistic reading of your controls, recalculate it now using the 1, 3, and 5 point control weights. An outdated or inflated score is a standing representation to the government.
- Verify your cloud providers against the FedRAMP Moderate baseline. This was a specific allegation in the ILC Dover case. Obtain current authorization documentation from every provider storing CUI, and confirm the scope of what they actually host for you.
- Audit your system security plan against your actual environment. Walk the SSP control by control. Where the document describes a control that is not operating, either fix the control or update the document and the POA&M. The allegation here was not just missing controls but missing and outdated SSPs.
- Treat your POA&M as a live risk register. Confirm it identifies current weaknesses, has owners and target dates, and is reviewed at least quarterly. A POA&M that has not been touched in a year is itself a compliance gap.
- Review internal escalation records. If your security staff have flagged the same unremediated gaps repeatedly, resolve them or formally accept and document the risk at the executive level. The whistleblower in this case was the company's own cybersecurity director.
- Confirm your incident response obligations are operationally ready. DFARS 252.204-7012 requires reporting a cyber incident affecting covered defense information to DoD within 72 hours of discovery via dibnet.dod.mil, using a DoD-approved medium assurance certificate obtained in advance. If no one on your team holds that certificate, obtain one now.
- Scope your CUI boundary. Enclaving CUI into a narrowly scoped boundary, typically a GCC High tenant or a dedicated cloud landing zone, reduces the surface the 110 controls must cover, shortens assessment timelines, and lowers ongoing cost.
- Validate cryptography. NIST SP 800-171 requires FIPS-validated cryptography to protect the confidentiality of CUI. Strong but unvalidated encryption does not meet the requirement, and this is a common finding.
- Brief your executive team and board on representation risk. The first quarterly board memo in a well-run program is two pages, executive summary on top, plain English. Make sure leadership understands that cybersecurity attestations on government contracts carry False Claims Act exposure.
How Petronella Technology Group, Inc. Helps
Petronella Technology Group, Inc. is a Cyber AB Registered Provider Organization, RPO #1449, and every engineer assigned to a defense client holds the CMMC Registered Practitioner credential. An RPO prepares contractors for assessment; only a C3PAO can issue a CMMC Level 2 certificate, and Petronella Technology Group, Inc. does not perform certification assessments. What we do is build the operating evidence that makes your attestations true.
Our CMMC compliance consulting practice runs a typical Level 2 readiness engagement in 12 to 14 weeks for a mid-size contractor: discovery in week one, gap analysis in weeks two through four, a remediation sprint in weeks five through twelve, and C3PAO readiness handoff in weeks thirteen and fourteen. Deliverables include a system security plan covering all 110 NIST SP 800-171 controls with owners and evidence pointers, 14 control-family policies plus an incident response plan, a live POA&M, a mock assessment using the Cyber AB CMMC Assessment Process, a baselined SPRS score, and a C3PAO shortlist. We also publish a C3PAO selection guide for DoD contractors to help you choose an assessor when you are ready.
For contractors who need ongoing security leadership, our vCISO service delivers a written current-state assessment within 30 days of engagement, maps existing controls to your framework, ranks gaps by priority, and produces a 90 to 180 day remediation roadmap written for the executive reader. The named vCISO can serve as security officer of record for CMMC senior official authorization, with formal designation documentation. For continuous assurance, our managed detection and response service provides 24/7 monitoring with AI-powered analytics and human-led investigation, and its reporting is designed to provide the evidence auditors need for CMMC and NIST 800-171 verification. Our private AI cluster and hybrid SOC serve defense industrial base clients that cannot send CUI to a public-cloud SOC.
If your organization also handles electronic protected health information, the same documentation discipline applies, and our HIPAA compliance practice aligns your program to NIST SP 800-66 Rev. 2 and the OCR audit protocol. Start with our CMMC resources for defense contractors or check your current standing with our SPRS score calculator for NIST 800-171.
Related reading
- CMMC Compliance: Gap Assessment, Levels 1 to 3
- ILC Dover to Pay $13 Million Over Cybersecurity Compliance
- DOJ Uses False Claims Act in Honeywell Cyber Fraud Settlement
- False SPRS Score Costs a Defense Contractor $507,144
- Government Contractors at Risk: DOJ Cybersecurity Crackdowns
Sources
- DoD contractor to pay $13 million over alleged cyber compliance failures in Army, MDA, NASA contract
- 45 CFR Part 164 - Subpart C - Security Standards for the Protection of Electronic Protecte
- SP 800-66 Rev. 2, Implementing the Health Insurance Portability and Accountability Act (HI
Frequently Asked Questions
Why did ILC Dover pay $13 million if there was no determination of liability?
Because the settlement resolves the allegations without litigation. The Justice Department stated there has been no determination of liability, which is standard in False Claims Act settlements: the contractor pays to close the matter and avoids the cost and risk of trial. The $13 million agreement with ILC Dover LP and ILC Astrospace LLC is the largest False Claims Act cybersecurity settlement to date.
What did the contractors allegedly do wrong?
The Justice Department alleged that from January 2018 to October 2024 the companies misrepresented compliance with contractual cybersecurity requirements on Army, Missile Defense Agency and NASA contracts. Specific allegations included storing controlled unclassified information with an external cloud provider without ensuring it met FedRAMP Moderate baseline requirements, failing to fully implement controls under NIST SP 800-171 and NIST SP 800-53, failing to develop and update system security plans for covered systems, and failing to develop and implement plans of action and milestones.
Does this case affect subcontractors or only primes?
It should concern both. The cybersecurity clauses at issue flow down to subcontractors when performance involves covered defense information, and a subcontractor that makes compliance representations on a covered contract faces the same False Claims Act exposure. The cloud provider allegation in this case also shows that the government examines the third parties holding your CUI, not just your own network.
Is CMMC still required given the recent deadline suspension?
The DoD CIO suspended the November 10, 2026 Phase Two deadline on July 13, 2026, and later milestones are paused until further notice, but Phase One self-assessments remain in force. More importantly for this case, the DFARS 252.204-7012 obligation to implement NIST SP 800-171 controls predates CMMC entirely and remains in existing contracts. The ILC Dover allegations arose under those kinds of obligations, not under a CMMC certificate requirement.
Could my own security team file a whistleblower claim against my company?
Any employee with knowledge of false claims submitted to the government can file a qui tam lawsuit under the False Claims Act, and the whistleblower here was ILC's former Director of Cybersecurity, who will receive a $2.35 million share of the settlement. The practical defense is not silence but remediation: close the gaps, keep your SSP and POA&M current, and make sure your attestations match reality before they are signed.
How do I know if my company is at risk of a similar claim?
Start with three questions. Is your SPRS self-assessment score current and honest? Does your system security plan describe controls that are actually operating? Do your cloud providers storing CUI meet the FedRAMP Moderate baseline? If the answer to any of these is no or unknown, you have the raw material for exactly the kind of allegations in this case, and you should address it before the next contract submission.
If this settlement raised questions about your own compliance posture, call Penny, our AI assistant, at 919-348-4912 to book a free 30-minute scoping consultation with a CMMC Registered Practitioner, or reach us through our contact form. Petronella Technology Group, Inc. has served clients since 2002 and delivers CMMC and HIPAA engagements remote-first across all 50 states.
Online course from the Petronella Technology Group, Inc. Training Academy
CMMC Level 2 Security Awareness: Common Core
Foundational CMMC Level 2 awareness for all roles: CUI, insider threat, phishing, passwords and MFA, physical security, and incident reporting.
Price: $49
Free, practical, and specific to regulated environments. We will email it to you.
No spam. Unsubscribe anytime.
