High-Profile False Claims Act Settlement Highlights the Importance of Compliance with Federal Cybersecurity Requirements
On September 1, 2026, the US Department of Justice (DOJ) issued a public release (Office of Public Affairs | Honeywell Aerospace Inc. Agrees to Pay Over $2M to Settle False Claims Act Allegations of Failing to Comply with Cybersecurity Requirements in a US Department of Defense Contract | United States Department of Justice) announcing that Honeywell Aerospace Inc. (Honeywell) agreed to pay over $2 million to resolve allegations that the federal contractor was liable under the False Claims Act (FCA), 31 U.S.C. §§ 3729-3733, for failing to comply with Department of Defense (DoD) contractual cybersecurity requirements.
According to DOJ, the settlement arose in connection with a whistleblower action filed under the FCA’s qui tam provisions. The government alleged that, from April 2020 through December 2023, a Honeywell business unit submitted false claims for payment while failing to meet cybersecurity requirements specified in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, with respect to one of the Company’s networks.
Defense contractors and subcontractors that process, store, or transmit Controlled Unclassified Information (CUI) require compliance with the requirements set forth at DFARS 252.204-7012 (Defense Federal Acquisition Regulation Supplement (DFARS), (Safeguarding Covered Defense Information and Cyber Incident Reporting). Among other things, DFARS clause 252.204-7012 requires contractors and subcontractors to protect and safeguard CUI and implement the security requirements of NIST SP 800-171. Accordingly, contractors who fail to comply with DFARS 252.204-7012 and other DFARS cybersecurity provisions, but nevertheless present claims for contractual payments, are subject to False Claims Act liability for such non-compliances under an implied certification theory of relief.
As Butzel has highlighted in prior alerts, DOJ has prioritized efforts to use the FCA to enforce compliance with contractual cybersecurity requirements—and to publicize high-profile enforcement actions to impress upon contractors the importance of safeguarding sensitive government systems and information. Thus, this latest settlement should serve as a warning to contractors and subcontractors to carefully assess their cybersecurity posture against the foundational requirements of NIST SP 800-171 before executing DoD contracts or subcontracts.
It is also worth noting that such compliance measures remain critical even in the face of DoD’s temporary suspension of the rollout out of Phase II of its Cybersecurity Maturity Model Certification (CMMC) program. Even during this pause, DoD has made clear that it expects all contractors and subcontractors to safeguard CUI in accordance with DFARS 252.204-7012.
Butzel’s Aerospace and Defense and Cybersecurity teams regularly advise companies on federal cybersecurity requirements, defense-contract flow-downs, NIST SP 800-171 implementation, CMMC readiness, cybersecurity gap assessments, remediation planning, subcontractor compliance, incident-response readiness, and False Claims Act risk mitigation.
For additional information, please contact the authors or your Butzel attorney.
Derek Mullins
313.983.6944
mullins@butzel.com
Beth Gotthelf
248.258.1303
gotthelf@butzel.com
Anthony Scalise
248.258.2612
scalise@butzel.com
Claudia Rast
734.213.3431
rast@butzel.com
Jennifer M. Smith-Veluz
202.454.2885
smithveluz@butzel.com
