DOJ Secures $13 Million From DoD Contractor in Largest Cybersecurity FCA Resolution to Date

Qui Notes: Unlocking the False Claims Act

By Tirzah S. Lollar Megan Pieper

Last week, the U.S. Department of Justice (DOJ) announced what is by our count its 17th settlement under its 2021 Civil Cyber-Fraud Initiative. Defense and aerospace companies ILC Dover and ILC Astrospace (collectively, ILC) agreed to pay $13 million to resolve allegations they violated the False Claims Act (FCA) by failing to comply with cybersecurity requirements in their government contracts. This is the 10th settlement resolving allegations of non-compliance with DFARS 252.204-7012 and failure to implement the NIST SP 800-171 controls and, as noted, DOJ’s largest single recovery in a cyber FCA matter to date. Half of the settlement ($6.5 million) is identified as restitution, meaning that a multiplier of two was used.

The case was filed by ILC’s former Director of Security who alleged that he had raised concerns internally about the company’s non-compliance, but ILC did not take steps to address those concerns. He will receive $2.35 million of the recovery. Of the now 17 settlements under the initiative, 11 were initiated by relators. Here, Relator also alleged violations by other defendants: a private equity firm that owned ILC; Ingersoll Rand, which acquired ILC from the private equity firm; and Gray Analytics, a cybersecurity risk management company and accredited Cybersecurity Maturity Model Certification third-party assessment organization that did work for ILC. DOJ intervened only as to ILC and for the purpose of settlement and the claims against the other defendants have been voluntarily dismissed.

Turning back to ILC, without admitting liability, it settled allegations that it submitted false claims for payment in connection with U.S. Army, Missile Defense Agency, and National Aeronautics and Space Administration (NASA) contracts for each of the following reasons:

ILC used an external cloud service provider to store Covered Defense Information without ensuring that the provider met the security requirements equivalent to the Federal Risk and Authorization Management Program Moderate baseline and complied with DFARS 252.204-7012. (While not in the settlement agreement, Relator alleged, for example, that ILC used the standard Office 365 rather than Office 365 GCC High for email.)
ILC did not document and periodically update a System Security Plan (SSP) for each of its covered information systems.
ILC did not fully implement all cybersecurity controls in NIST SP 800-171 and NIST SP 800-53 as allegedly required by DFARS 252.204-7012 and its NASA contracts, respectively, although it was informed by its third-party cybersecurity consultants that dozens of controls were not implemented.
- Under the NIST SP 800-171 assessment methodology, ILC’s failure to implement these controls would have resulted in scores of -59 and 21, respectively, if ILC had an SSP in place permitting such a score to be calculated. ILC did not report these scores or cybersecurity vulnerabilities to DoD.
ILC had not developed and implemented Plans of Action and Milestones (POA&Ms) to correct deficiencies as required by NIST SP 800-171 and NIST SP 800-53.
ILC was ineligible to be considered for award of DoD contracts because ILC Astrospace had not posted any assessment to the Supplier Performance Risk System and ILC Dover had not submitted an appropriate assessment in accordance with the NIST SP 800-171 assessment methodology.

Takeaways

At the risk of sounding like a broken record, this most recent settlement underscores yet again that would-be relators, the relator’s bar, and DOJ are focused on potential cyber FCA-related matters. That so many (11 out of 17, or 64%) were initiated by relators who, as here, typically worked at the relevant companies with some sort of responsibility for cybersecurity, information technology, and/or information security, demonstrates the importance of responding appropriately when concerns are raised internally and using care when interacting with potential relators. The ILC Relator also asserted retaliation claims against ILC and Ingersoll Rand, claiming that he was terminated for raising his cybersecurity concerns. ILC appears to have resolved those claims for $180,000 (referred to as the “Non-Covered Conduct Claim Payment” in the settlement agreement). This settlement also demonstrates what we have seen before — so far, there have been very few companies inclined to litigate these types of cases, opting instead to settle.

Stay tuned to Qui Notes for more reporting on cyber FCA matters and look to our Cyber FCA Tracker for a quick snapshot of DOJ’s recoveries under the Civil Cyber-Fraud Initiative.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Blog post is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.