Cyber Resilience
← All news
Confirmed

Honeywell Aerospace Inc. Agrees to Pay Over $2M to Settle False Claims Act Allegations of Failing to Comply with Cybersecurity Requirements in a U.S.

Our takeHoneywell pays $2.04M to settle False Claims Act allegations over DoD cybersecurity requirements it signed up to. The mechanism matters: attestation is enforceable. If your shop — any size — certifies compliance to win federal work, that signature carries liability.Cyber Resilience desk

This is closer to what predictable enforcement should look like. The cybersecurity requirements were written into the contract before liability attached, and the consequence is a civil corporate settlement — not a prosecutor building a case against an individual security executive after the fact, as in the Sullivan and Brown prosecutions. Contractors could know the rules in advance; Honeywell allegedly didn't meet them and is paying $2,042,518 for it. The advice doesn't split by size: the False Claims Act doesn't scale down for headcount, and defense subcontractors of every size sign the same attestations. If you certify cybersecurity compliance to win a federal contract, treat that certification like a financial statement — someone can, and increasingly will, hold you to it.

Sources (2)
What this means for you — Security leader:Review all active DoD contracts for DFARS 252.204-7012 and NIST 800-171 compliance; if gaps exist, document them and accelerate remediation to avoid False Claims Act exposure.
What this means for you — Lean IT orgs:If you hold any DoD subcontracts, check whether you were required to meet specific cybersecurity rules — document your status and fix gaps quickly, or you could face similar penalties.
What this means for you — MSP:Audit clients with any DoD or aerospace prime/sub contracts for 7012 and 800-171 adherence; surface gaps immediately and help them build evidence of good-faith compliance.
What this means for you — Researcher:False Claims Act settlements now explicitly treat cybersecurity noncompliance as a false claim; track how DOJ uses this lever on future contracts.