Civil Law

Key Takeaways

• DOJ used the FCA to settle with Honeywell Aerospace Inc. for $ 2,042,518 over allegations that a Honeywell business unit submitted claims for payment under a DoW contract while failing to comply with NIST SP 800-171 cybersecurity requirements incorporated through DFARS 252.204-7012, reinforcing that cybersecurity compliance failures can create significant FCA exposure for defense contractors.

• The settlement arose from a 2022 qui tam whistleblower action filed by a former Honeywell employee, and DOJ reported a record 1,297 qui tam lawsuits filed in FY 2025, underscoring the critical role of internal whistleblowers in driving cybersecurity FCA enforcement under DOJ’s Civil Cyber-Fraud Initiative.

• Notably, the government’s allegations focused on Honeywell’s failure to satisfy required NIST SP 800-171 controls rather than any identified cyberattack or data breach, confirming that FCA risk can arise from a disconnect between contractual cybersecurity obligations and a contractor’s actual compliance posture even in the absence of a security incident.

The Department of Justice (DOJ) continues to use the False Claims Act (FCA) to pursue government contractors for alleged failures to comply with contractual cybersecurity requirements. On September 1, DOJ announced that Honeywell Aerospace Inc. agreed to pay $ 2,042,518 to resolve allegations that a Honeywell business unit failed to comply with required cybersecurity controls under a Department of War (DoW) contract. The settlement is the latest example of DOJ treating cybersecurity compliance as more than an information technology issue. For federal contractors, deficiencies in required cybersecurity controls can also create significant FCA exposure.

What Were DOJ’s Allegations Against Honeywell Regarding NIST SP 800-171 Compliance?

According to DOJ, from April 2020 through December 2023, a business unit of Honeywell International Inc. allegedly submitted false claims for payment while failing to comply with cybersecurity requirements contained in National Institute of Standards and Technology (NIST) Special Publication 800-171. Those requirements applied to Honeywell through its DoW contract and applicable regulations.

The government contended that Honeywell knowingly submitted false claims for payment while failing to comply with NIST SP 800-171 with respect to its Grey Network and Gold Network, as required by DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, and the applicable contract. Of the approximately $ 2.04 million settlement, $ 972,628 constitutes restitution. Honeywell did not admit liability and the settlement does not constitute a concession by the government that its claims lacked merit.

DFARS 252.204-7012 requires contractors to provide adequate security for covered contractor information systems. For covered systems that are not operated on behalf of the government, the clause generally requires implementation of the security requirements in NIST SP 800-171. Those requirements are designed to safeguard controlled unclassified information residing in nonfederal information systems.

How Do Qui Tam Whistleblower Actions Drive Cybersecurity FCA Enforcement?

The Honeywell matter also highlights the role of whistleblowers in cybersecurity FCA enforcement. The case originated from a 2022 qui tam action filed by a former Honeywell employee under the FCA’s whistleblower provisions. Under those provisions, private parties may bring FCA claims on behalf of the United States and receive a portion of any government recovery. The former employee will receive $ 375,823.46 as their share of the Honeywell settlement.

That feature of the FCA is particularly relevant for cybersecurity compliance because employees with responsibility for information technology, cybersecurity, contracts, or compliance may have direct knowledge of differences between a contractor’s contractual representations and its actual cybersecurity posture. DOJ reported that 1,297 qui tam lawsuits were filed in FY 2025, the highest number ever recorded in a single year and specifically identified contractors’ knowing violations of applicable cybersecurity requirements as an area of continued FCA enforcement.

What Is DOJ’s Civil Cyber-Fraud Initiative and How Has It Been Used Against Contractors?

The Honeywell settlement fits within DOJ’s broader Civil Cyber-Fraud Initiative, which uses the FCA to pursue contractors and grant recipients that allegedly misrepresent their cybersecurity practices or knowingly fail to satisfy applicable cybersecurity obligations. DOJ launched the initiative in 2021 and has continued bringing cases involving alleged failures to implement contractual cybersecurity controls.

Earlier this year, for example, defense contractor LOGZONE Inc. agreed to pay $ 507,144 to resolve FCA allegations that it knowingly failed to comply with cybersecurity requirements under Navy contracts. DOJ similarly alleged that the contractor failed to comply with NIST SP 800-171 requirements incorporated through DFARS 252.204-7012.

The Honeywell settlement is also notable for what the public documents do not identify. Neither DOJ’s announcement nor the settlement agreement identifies a successful cyberattack or data breach as part of the covered conduct. Instead, the government’s allegations focus on Honeywell’s alleged failure to satisfy required NIST SP 800-171 controls while submitting claims for payment. This reinforces that FCA risk may arise from a disconnect between contractual cybersecurity obligations and a contractor’s actual compliance posture even without an alleged breach.

What Steps Should Defense Contractors Take to Reduce Cybersecurity FCA Risk?

The Honeywell settlement provides another reminder that contractors should treat cybersecurity representations and contractual requirements with the same care as other certifications that can create FCA exposure. Contractors subject to DFARS 252.204-7012 should ensure that cybersecurity personnel, contracts professionals, and compliance teams are aligned on which systems process covered defense information, which NIST SP 800-171 requirements apply, and whether the company’s actual practices are consistent with its contractual obligations.

Contractors should also have processes for identifying, documenting, escalating, and remediating known cybersecurity deficiencies. Internal concerns should receive particular attention because the Honeywell matter demonstrates how cybersecurity issues identified inside a company can later form the basis of a qui tam action. As DOJ continues to pursue cybersecurity-related FCA matters, contractors should expect the accuracy of their cybersecurity representations and the implementation of required controls to remain an important enforcement focus.

Please contact the author if you have any questions.

Home – LexBlog