ILC Dover and ILC Astrospace Pay $13 Million Over Cybersecurity Lapses

ILC Dover and ILC Astrospace agreed to pay $13 million to resolve False Claims Act allegations that they billed defense contracts without meeting required cybersecurity standards.

By USA 24 Editorial TeamNovember 7, 20265 min read

A gloved technician inspects a folded fabric component on a clean-room bench under cool overhead light, with storage bins blurred behind.

ShareX Facebook LinkedIn Reddit Email

The ILC Dover cybersecurity settlement carries a $13 million price tag. ILC Dover LP and ILC Astrospace LLC agreed to pay that sum to resolve False Claims Act allegations that they submitted claims on federal defense contracts while knowing they had not met the cybersecurity standards those contracts required. The Justice Department secured the deal, and it shows that a cyber lapse in a federal contract can now lead to fraud liability.

For defense and aerospace contractors, and for the subcontractors beneath them, that changes the math on a security gap. A missed control used to mean a failed audit or a lost bid. Now it can mean a federal fraud claim.

What the Justice Department alleges against ILC

According to the government's account reported by CyberScoop, the two companies submitted claims for payment on federal defense contracts covering 2018 to 2024. The government says they did so while knowing they had not met those contracts' mandated cybersecurity standards.

The Justice Department's account, as reported by ClearanceJobs, names contracts with the Army, the Missile Defense Agency and NASA. ClearanceJobs published its coverage on November 6, and the story is still being picked up across the defense trade press.

The settlement came without an admission of liability. Parent company Ingersoll Rand, an American industrial manufacturer, said it inherited the compliance problem when it bought the firm. That is the company's own characterization, and it has not been tested independently.

The coverage reviewed for this story does not describe which specific cybersecurity controls ILC failed to meet. Anyone trying to judge the seriousness of the allegations should pull the full Justice Department text before drawing conclusions about the technical failures.

Brett Shumate, the Assistant Attorney General for the Justice Department's Civil Division, put the message plainly in remarks quoted by CyberScoop: “defense and aerospace contractors must comply with the cybersecurity requirements.”

Why a cybersecurity lapse can become a fraud case

The False Claims Act lets private whistleblowers sue on the government's behalf and share in any recovery. That mechanism is the reason cybersecurity compliance has moved from the contracting office to the legal department. An employee who believes a company billed the government while falling short of required controls can bring the case, and the government can then join or take it over.

The ILC matter is not the first of its kind. On September 1, 2026, the Justice Department announced that Honeywell Aerospace agreed to pay $2,042,518 to settle allegations over gaps against NIST SP 800-171 in a Defense Department contract. The Justice Department release on Honeywell says that case began with a whistleblower suit, and the whistleblower received $375,823 as their share.

In that release, Shumate said: “The Justice Department will continue to investigate potential violations of these cybersecurity requirements to protect this critical information.” The line is a signal that the Honeywell settlement was not a one-off.

Yahoo Finance's report on the Honeywell settlement describes a broader pattern in which the Justice Department has sued government contractors for allegedly failing NIST's defense cybersecurity rules while still submitting claims for payment. The law firm Shumaker, quoted in the same coverage, describes cybersecurity compliance as “increasingly becoming enterprise legal risk.”

Which contractors carry the most exposure

The exposure is broad. Under the Defense Federal Acquisition Regulation Supplement, the NIST SP 800-171 controls apply to subcontracts, including subcontracts for commercial products and services, when covered defense information is involved, according to Nixon Peabody's analysis of the Honeywell settlement. A small supplier that never holds a prime contract can still be bound by those requirements.

The Level 2 self-assessments under the Cybersecurity Maturity Model Certification program measure a company against the 110 requirements in NIST SP 800-171 Revision 2. Those scores are the numbers that go on paper, which is why accuracy matters so much. A score that describes the controls a company hoped it had, rather than the ones it actually ran, creates the kind of gap that can turn into a false claim.

The groups most affected are US defense and aerospace contractors, their subcontractors, and the federal agencies that buy from them. Consumers are not directly affected by this case.

Practical steps for contractors that hold federal data

The ILC and Honeywell matters point to a short list of things compliance and IT teams can do now. None of these steps replaces legal advice, but each one reduces the chance of a gap going unnoticed for years.

Recheck your NIST SP 800-171 self-assessment score against the controls you actually operate today, and document the evidence behind each claimed control.
Verify that every third-party host that stores or processes covered defense information meets the required security standards, and get written proof rather than relying on a vendor's marketing.
Document controls throughout contract performance, not only at assessment time, so you can show what was in place in any given year.
Audit acquired subsidiaries before and after a deal closes. The government's account of ILC covers 2018 to 2024, and Ingersoll Rand's claim that it inherited the problem shows how an acquisition can carry compliance debt forward.
Treat internal reports of control gaps as legal matters. Employees can file whistleblower suits under the False Claims Act, and a quiet fix to a documented gap may not satisfy a government investigator who asks why the gap existed.

What comes next for CMMC and DFARS

The rules are shifting under contractors while these cases move through the courts. Nixon Peabody notes that CMMC Phase II is paused, while the DFARS cyber clause still binds contractors today. Government contract attorneys quoted by CyberScoop say a forthcoming regulatory overhaul could expose more companies to False Claims Act penalties.

Several questions remain open. The reporting does not show whether the ILC settlement is part of a broader sweep of defense contractors, and it does not say what the forthcoming overhaul will require. Those answers will shape how many companies face exposure and how quickly.

Watch for the full Justice Department release on ILC, which should confirm the announcement date and the contracting details. Watch also for any proposed rule that changes how self-assessments are scored or verified. If the government keeps pairing cyber requirements with fraud enforcement, the cost of an inaccurate score will keep rising for every company that signs a federal contract.

Frequently asked questions

How much did ILC Dover and ILC Astrospace agree to pay?

ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million in total to settle False Claims Act allegations. The settlement was reached without an admission of liability, according to the Justice Department as reported by CyberScoop. The contracts involved the Army, the Missile Defense Agency and NASA.

What time period does the ILC cybersecurity settlement cover?

The government says the noncompliance covered 2018 to 2024. Parent company Ingersoll Rand said it inherited the compliance problem when it bought the firm, a characterization that has not been independently tested. The specific cybersecurity failures at ILC were not detailed in the coverage reviewed for this story.

Do NIST SP 800-171 requirements apply to subcontractors?

Yes, when covered defense information is involved. The controls apply through the DFARS clause to subcontracts, including subcontracts for commercial products and services. Level 2 self-assessments under CMMC measure a company against the 110 requirements in NIST SP 800-171 Revision 2.

Can employees trigger a False Claims Act case over cybersecurity?

Yes. The False Claims Act lets private whistleblowers sue on the government's behalf and share in any recovery. The Honeywell case began with a whistleblower suit, and that whistleblower received $375,823 as their share.

Is CMMC currently enforced?

Nixon Peabody notes that CMMC Phase II is paused, while the DFARS cyber clause still binds contractors. Companies should not treat the pause as relief, because the contractual cybersecurity requirements and False Claims Act exposure remain in force.

Sources

#Cybersecurity #False Claims Act #Defense Contractors #NIST SP 800-171 #CMMC

About this article. Reported and produced by the USA 24 newsroom using the sources cited above. Read our editorial policy. Spotted an error? Tell us and we will correct it.