ILC Dover and ILC Astrospace agreed to pay $13 million over alleged False Claims Act cybersecurity compliance failures on Army, Missile Defense Agency, and NASA contracts, a settlement that shows how unmet contractual security obligations can become direct financial liability.
ClearanceJobs reported the settlement on November 6, 2026, in a roundup that also covered REI Systems activating its NASA SEWP VI contract and Finch AI achieving CMMC Level 2 certification. The story matters most to federal contractors and defense industrial base companies that handle controlled unclassified information, because it demonstrates how the False Claims Act converts cybersecurity shortcomings on government work into seven-figure payments. The reporting is available at ClearanceJobs.
Key Takeaways
- ILC Dover LP and ILC Astrospace LLC, Delaware-based defense and aerospace contractors, agreed to pay $13 million to resolve allegations that they violated the False Claims Act by failing to meet cybersecurity requirements under contracts with the Army, Missile Defense Agency, and NASA.
- Federal investigators alleged that between 2018 and 2024, the companies submitted claims for payment despite knowing they had not fully complied with contractual cybersecurity obligations.
- The alleged shortcomings included inadequate security controls, outdated or missing system security plans, and the use of third-party cloud storage for controlled unclassified information without ensuring the required protections were in place.
- The case originated as a whistleblower lawsuit filed by Philip Root, ILC's former director of cybersecurity, who will receive $2.35 million from the recovery.
- ILC's parent company, Ingersoll Rand, said it identified and addressed the issues following its June 2024 acquisition and was compliant with applicable requirements by October 2024; the companies resolved the matter without an admission or determination of liability.
The Facts in Detail
The settlement
According to the Department of Justice, as reported by ClearanceJobs, ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million to resolve allegations that they violated the False Claims Act. The contracts at issue were with the Army, the Missile Defense Agency, and NASA. The companies resolved the matter without an admission or determination of liability.
The alleged conduct
Federal investigators alleged that between 2018 and 2024, the companies submitted claims for payment despite knowing they had not fully complied with contractual cybersecurity obligations. The alleged shortcomings described in the reporting included inadequate security controls, outdated or missing system security plans, and the use of third-party cloud storage for controlled unclassified information without ensuring the required protections were in place.
The whistleblower
The settlement originated from a whistleblower lawsuit filed by Philip Root, ILC's former director of cybersecurity. Under the settlement, Root will receive $2.35 million from the recovery. This detail matters for contractors because it illustrates the insider dimension of False Claims Act cybersecurity cases: the person with the clearest view of a compliance gap may be the one who brings it forward.
The post-acquisition cleanup
ILC's parent company, Ingersoll Rand, said it identified and addressed the issues following its June 2024 acquisition and was compliant with applicable requirements by October 2024. The settlement followed that remediation. The reporting does not describe the specific remediation steps taken, nor does it explain how the government measured the companies' compliance status at any point in the timeline.
The same report's other federal IT news
The ClearanceJobs item that carried the settlement news also reported that Sterling, VA-based REI Systems activated its NASA Solutions for Enterprise-Wide Procurement (SEWP) VI contract. Originally awarded in June 2026, the Category B contract became active November 1 and covers enterprise IT services including artificial intelligence, cloud modernization, cybersecurity, data analytics, and systems integration. The governmentwide acquisition contract carries a $20 billion ceiling per contract holder over a 10-year ordering period, a figure that represents potential contracting capacity rather than guaranteed revenue. REI Systems, a 100% employee-owned company founded in 1989 with a single NASA contract, can now compete for federal technology modernization work across agencies, not only at NASA.
The same report also noted that Herndon, VA-based Finch AI achieved Cybersecurity Maturity Model Certification (CMMC) Level 2 following an independent assessment by Ace of Cloud, an authorized third-party assessment organization. Finch AI credited KTL Solutions for guiding the company through the certification process. The certification demonstrates that Finch AI met the applicable cybersecurity requirements for protecting Controlled Unclassified Information, including 110 security requirements outlined in NIST SP 800-171. The report placed this in context: while the Pentagon paused the next phase of mandatory CMMC third-party assessments in July 2026 as it reviews the program, existing cybersecurity requirements remain in place.
Why Cybersecurity Compliance Exposure Works This Way
The legal mechanism in this case is the False Claims Act, which the Department of Justice used to allege that the companies submitted claims for payment while knowing they had not fully complied with contractual cybersecurity obligations. In other words, the alleged fraud was not a hack or a data theft. It was the act of billing the government for work performed under contracts that carried cybersecurity requirements the companies allegedly had not met.
The specific allegations map onto obligations that defense contractors will recognize. System security plans are a core documentation requirement under NIST SP 800-171, the publication that defines the security requirements for protecting controlled unclassified information in nonfederal systems. NIST's own guidance states that there is no prescribed format or specified level of detail for system security plans, but that organizations must ensure the required information is conveyed in those plans. A plan that is outdated or missing is not a paperwork defect in isolation; it is evidence about whether the controls it is supposed to describe actually exist and operate.
The third alleged shortcoming, third-party cloud storage of controlled unclassified information without ensuring the required protections, points to the supply chain dimension of these obligations. When a contractor places government data in a cloud environment, the contractor remains responsible for ensuring the protections required by the contract are actually in place. The Department of Defense's CMMC program rule at 32 CFR Part 170 establishes the assessment and certification ecosystem for these requirements, and the underlying NIST SP 800-171 requirements remain the technical baseline for protecting CUI.
For contractors navigating NIST requirements and the rollout of CMMC, the ClearanceJobs reporting draws the operational conclusion directly: cybersecurity compliance is not simply about passing an assessment. Contractors need to maintain the required protections and documentation throughout contract performance. A control that existed at award but lapsed in year three is still a compliance failure in year three, and every invoice submitted in the meantime is a claim under a contract whose conditions were allegedly not met.
The Finch AI item in the same report illustrates the certification pathway in its current form. CMMC Level 2 requires meeting the 110 security requirements of NIST SP 800-171, verified through an independent assessment by an authorized third-party assessment organization. The Pentagon's July 2026 pause of the next phase of mandatory CMMC third-party assessments does not suspend the underlying obligations; as the report states, protecting sensitive government information is still a priority even as the certification timeline evolves.
What the Evidence Does and Does Not Show
The settlement resolves allegations. The companies resolved the matter without an admission or determination of liability, which means the public record does not establish that the alleged conduct occurred as described. What is documented is the agreement to pay $13 million and the government's description of the allegations.
Several important details are not known from the sources. The reporting does not describe how federal investigators discovered the alleged noncompliance, what assessment methodology was used, or which specific security controls were found inadequate. It does not quantify the contract values at issue or explain how the $13 million figure was calculated relative to the claims submitted between 2018 and 2024.
The timeline of the Ingersoll Rand remediation is stated only at a high level: the parent company said it identified and addressed the issues following its June 2024 acquisition and was compliant by October 2024. The sources do not describe what remediation involved, who verified the October 2024 compliance status, or whether the government accepted that characterization.
It is also not known whether this settlement signals anything about how the Department of Justice will approach similar cases in the future. The reporting presents this as one resolution in a growing pattern of financial consequences for cybersecurity compliance failures across the defense industrial base, but it does not predict enforcement trends or provide comparative data on other cases.
Finally, the relationship between this settlement and the CMMC program's evolving timeline is stated only observationally. The report notes the Pentagon's July 2026 pause of the next phase of mandatory third-party assessments and that existing requirements remain in place. It does not address how the pause affects False Claims Act exposure for contractors currently operating under legacy DFARS cybersecurity clauses, and no source in this story answers that question.
Compliance and Risk Implications for Regulated Organizations
The ILC Dover settlement is a False Claims Act case, not a data breach case. That distinction is what makes it dangerous for contractors. Nobody in the reporting is alleged to have lost controlled unclassified information to an attacker. The allegation is that the companies submitted claims for payment between 2018 and 2024 while knowing they had not fully complied with contractual cybersecurity obligations, including inadequate security controls, outdated or missing system security plans, and third-party cloud storage for controlled unclassified information without the required protections in place. Under the False Claims Act, the act of billing the government while non-compliant is itself the exposure.
For any organization in a regulated supply chain, the practical consequence is that your compliance documentation is now evidence in a potential fraud case. A system security plan that is stale, a self-assessment score that no longer reflects reality, or a cloud environment that quietly drifted out of compliance is not just an audit finding. It is the factual predicate for an allegation that you billed for work you were contractually unqualified to perform.
The reporting also notes that the Pentagon paused the next phase of mandatory CMMC third-party assessments in July 2026 while it reviews the program, but that existing cybersecurity requirements remain in place. That pause is a scheduling change, not a safe harbor. The contractual obligation to protect controlled unclassified information did not pause with it, and the ILC Dover case covers conduct from 2018 through 2024, long before the current certification timeline was settled. Waiting for regulatory clarity is not a defensible strategy when the enforcement mechanism is a statute that predates all of it.
There is also a structural lesson in how this case came to light. It originated from a whistleblower lawsuit filed by Philip Root, ILC's former director of cybersecurity, who will receive $2.35 million from the recovery. Insider knowledge of compliance gaps, combined with a financial incentive to report them, is a risk vector most organizations never model. The people most likely to know about a stale system security plan or an unsecured cloud storage arrangement are the people who work on it every day.
What This Means for Regulated Industries
Defense Contractors and Aerospace Suppliers
This is the industry the case directly touches. The contracts involved were with the Army, the Missile Defense Agency, and NASA, and the alleged failures map closely to obligations that defense contractors already carry: maintaining the security controls required for covered systems, keeping system security plans current, and ensuring that any third-party cloud environment holding controlled unclassified information meets the required baseline. Under DFARS 252.204-7012, adequate security means the 110 controls of NIST SP 800-171 on every covered contractor information system, and DFARS 252.204-7019 requires a current self-assessment score posted to the Supplier Performance Risk System when an offer is submitted.
Three actions deserve immediate attention. First, verify that your SPRS score reflects your current environment, not the environment as it existed when you scored it. Second, confirm that every system security plan has a named owner and has been reviewed within a defined cycle; the fact sheet guidance on CMMC readiness treats the SSP as a living document with the POA&M reviewed at least quarterly, and that same discipline is what would have prevented the documentation failures alleged here. Third, if you use third-party cloud storage for controlled unclassified information, verify the provider's authorization status against the actual requirement. The DoD CIO FAQ has clarified that encrypted CUI is still CUI, and encrypted CUI in a cloud still needs FedRAMP Moderate or equivalency.
Contractors preparing for eventual CMMC Level 2 certification should also note that the readiness work and the False Claims Act defense are the same work. A current SSP, a live POA&M, and an accurate self-assessment score are the artifacts that demonstrate good faith if allegations ever arise. Our CMMC consultant services and the 2026 CMMC Compliance Guide cover how those artifacts are built and maintained.
Healthcare Organizations
Healthcare entities are not federal contractors in most cases, but the enforcement logic travels. The False Claims Act theory in this case is that billing the government while non-compliant is fraud. Healthcare has its own version: billing federal programs while failing to maintain the safeguards required under the HIPAA Security Rule, which requires a Risk Analysis under 45 CFR 164.308(a)(1)(ii)(A) along with 18 standards across administrative, physical, and technical safeguards. A covered entity that cannot produce a current risk analysis or evidence of operating safeguards is exposed in any enforcement action, audit, or breach investigation, because the documentation gap undermines the claim that protections were in place during the period billed.
The operational takeaway is the same as for defense contractors: keep the risk analysis current, keep safeguard documentation aligned to actual practice, and treat any known gap as a remediation project with dates and owners rather than a known issue that persists quietly. There is no HHS-issued HIPAA certification, so documentation aligned to NIST SP 800-66 Rev 2 and the HHS Office for Civil Rights audit protocol is the practical standard.
Legal and Financial Services Firms
Law firms and financial practices rarely hold federal contracts, so the False Claims Act angle is largely inapplicable, and this analysis will not stretch it to fit. What does apply is the insider risk and the documentation discipline. The whistleblower in this case was the company's own director of cybersecurity. Firms that handle sensitive client data should assume that any employee or former employee who knows about a security gap could report it, to a regulator, a client, or opposing counsel in future litigation. The defense is not secrecy. It is a documented, actively maintained compliance program where known gaps are tracked and closed on a schedule.
For financial firms, the SOC 2 framework's five Trust Services Criteria, including Security and Confidentiality, provide a structure for that documentation, and PCI DSS v4.0.1 covers 12 control areas for any firm that touches cardholder data. The specific framework matters less than the habit: a written current-state assessment, a prioritized remediation roadmap, and evidence that the roadmap is being executed.
An Action Plan for This Month
Security and IT leaders can act on this story now, without waiting for regulatory developments. Here is a concrete sequence:
- Locate every system security plan in your environment. Confirm each one has a named owner, a last-reviewed date, and a version history. Anything older than a year is a finding.
- Recheck your SPRS self-assessment score against current reality. If your environment has changed since the score was calculated, the score is stale, and DFARS 252.204-7019 requires a current score when an offer is submitted.
- Inventory every location where controlled unclassified information is stored, including third-party cloud services. For each one, document the authorization basis and compare it to the applicable requirement.
- Verify FIPS-validated cryptography on systems holding CUI. NIST SP 800-171 requires FIPS-validated cryptography to protect the confidentiality of CUI; strong but unvalidated encryption does not meet the requirement.
- Review your incident reporting readiness. DFARS 252.204-7012 requires reporting a cyber incident affecting covered defense information to DoD within 72 hours of discovery via dibnet.dod.mil, using a DoD-approved medium assurance certificate obtained in advance. If you do not hold that certificate, obtaining one is a this-month task.
- Confirm the 90-day preservation capability. After a reported incident, affected system images and monitoring data must be preserved for at least 90 days. Verify your logging retention actually supports that.
- Check subcontractor flow-down. DFARS 252.204-7012 must be flowed down to subcontractors when performance involves covered defense information. Confirm your agreements and your subcontractors' attestations are current.
- Establish or refresh an internal reporting channel for security staff. The whistleblower in this case was the director of cybersecurity. Give your security team a formal, low-friction path to escalate compliance concerns internally, and document that concerns raised were addressed.
- Review any pending M&A or acquisition activity from a compliance lens. Ingersoll Rand said it identified and addressed the issues following its June 2024 acquisition and was compliant by October 2024. If your organization is acquiring a contractor, the target's compliance posture becomes your liability on day one.
- Put the remediation items on a dated roadmap with an executive owner. A gap analysis without dates, owners, and executive visibility is exactly the kind of documented-but-ignored problem that becomes evidence later.
How Petronella Technology Group, Inc. Helps
Petronella Technology Group, Inc. is a Cyber AB Registered Provider Organization, RPO #1449, and every engineer assigned to a defense client holds the CMMC Registered Practitioner credential. As an RPO, we prepare organizations for assessment; authorized C3PAOs conduct Level 2 certification assessments, and we do not perform certification assessments for any organization.
For contractors facing the obligations described in this case, our CMMC readiness consulting delivers the artifacts that matter: a system security plan covering all 110 NIST SP 800-171 controls with owners and evidence pointers, control-family policies, a live POA&M, a mock assessment using the Cyber AB CMMC Assessment Process, a baselined SPRS score, and a C3PAO shortlist. A typical Level 2 readiness engagement runs 12 to 14 weeks for a mid-size contractor, from discovery through gap analysis, remediation, and C3PAO readiness handoff.
For organizations that need ongoing security leadership rather than a single project, our cybersecurity compliance services and vCISO practice provide a named security officer of record, a written current-state assessment within 30 days, and a 90 to 180 day remediation roadmap written for the executive reader. For clients who need continuous protection of sensitive data, our managed security services include 24/7 monitoring and detection designed to produce the evidence auditors need for CMMC, HIPAA, PCI DSS, SOC 2, and NIST 800-171 verification, with a private AI cluster that serves defense industrial base clients who cannot send CUI to a public-cloud SOC.
Leaders who want a broader view of how frameworks compare can start with our compliance framework comparison chart, and teams that need to build internal knowledge can review our CMMC, HIPAA and cybersecurity training options. You can also read more analysis on our cybersecurity blog.
Related reading
- CMMC Compliance: Gap Assessment, Levels 1 to 3
- False SPRS Score Costs a Defense Contractor $507,144
- DOJ Uses False Claims Act in Honeywell Cyber Fraud Settlement
- Government Contractors at Risk: DOJ Cybersecurity Crackdowns
- CMMC Guidelines for Defense Contract Compliance [2026]
Sources
- REI Systems Lands NASA SEWP VI Contract and Defense Contractors to Pay $13 Million Over Cybersecurit
- Launch Your Career
- Security Clearance Jobs
- 32 CFR Part 170 - CYBERSECURITY MATURITY MODEL CERTIFICATION (CMMC) PROGRAM
- SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems an
Frequently Asked Questions
Why did ILC Dover pay $13 million if no data was breached?
Because the False Claims Act exposure is based on billing, not breaches. The Department of Justice alleged that between 2018 and 2024, the companies submitted claims for payment despite knowing they had not fully complied with contractual cybersecurity obligations on contracts with the Army, Missile Defense Agency, and NASA. The alleged shortcomings included inadequate security controls, outdated or missing system security plans, and third-party cloud storage for controlled unclassified information without required protections.
Who reported the ILC Dover cybersecurity compliance failures?
The case originated from a whistleblower lawsuit filed by Philip Root, ILC's former director of cybersecurity, who will receive $2.35 million from the $13 million recovery. This is a reminder that the people with the most knowledge of your compliance gaps are often your own security staff.
Did ILC Dover admit liability in the settlement?
No. The companies resolved the matter without an admission or determination of liability. ILC's parent company, Ingersoll Rand, said it identified and addressed the issues following its June 2024 acquisition and was compliant with applicable requirements by October 2024.
Does the CMMC pause mean contractors can delay compliance work?
No. The Pentagon paused the next phase of mandatory CMMC third-party assessments in July 2026 while reviewing the program, but existing cybersecurity requirements remain in place. Contractual obligations under DFARS clauses and NIST SP 800-171 continue, and the ILC Dover allegations cover a period long before the current certification timeline existed.
What should a defense contractor do first after reading this case?
Verify that your system security plans and SPRS self-assessment score reflect your current environment, and confirm that any third-party cloud service holding controlled unclassified information meets the required baseline. Those are the three categories of alleged failure in this case, and each is directly checkable within a month.
How does this case affect companies outside the defense industrial base?
The False Claims Act applies to government billing, so the direct legal exposure is limited to federal contractors. However, the underlying lesson applies broadly: billing or operating while knowingly non-compliant with security obligations creates legal and regulatory risk in any regulated sector, and documented, actively maintained compliance programs are the practical defense.
If your organization needs help assessing where it stands, call Penny, our AI assistant, at 919-348-4912 to book a consultation, or reach Petronella Technology Group, Inc. through our contact form. The first call is a free 30-minute scoping consultation run by a CMMC Registered Practitioner.
Related reading: DOJ’s $2 Million Honeywell Settlement Under the Civil Cyber-Fraud Initiative: What Complia.
Free, practical, and specific to regulated environments. We will email it to you.
No spam. Unsubscribe anytime.
