# ILC Dover and ILC Astrospace Pay $13 Million Over Cybersecurity Lapses

- URL: https://usa-24.com/ilc-dover-cybersecurity-settlement/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-07T11:25:02.130Z
- Updated: 2026-11-07T11:25:02.138Z
- Topics: Cybersecurity, False Claims Act, Defense Contractors, NIST SP 800-171, CMMC

> ILC Dover and ILC Astrospace agreed to pay $13 million to resolve False Claims Act allegations that they billed defense contracts without meeting required cybersecurity standards.

## Key takeaways

- ILC Dover and ILC Astrospace agreed to pay $13 million to settle False Claims Act allegations tied to federal defense cybersecurity contract requirements.
- The government says the noncompliance covered 2018 to 2024, and the settlement was reached without an admission of liability.
- The contracts involved the Army, the Missile Defense Agency and NASA, according to the Justice Department's account as reported by ClearanceJobs.
- A separate Honeywell Aerospace settlement announced September 1, 2026, cost $2,042,518 over NIST SP 800-171 gaps and began with a whistleblower suit.
- According to Nixon Peabody, CMMC Phase II is paused, but the DFARS cyber clause still binds contractors.

The ILC Dover cybersecurity settlement carries a $13 million price tag. ILC Dover LP and ILC Astrospace LLC agreed to pay that sum to resolve False Claims Act allegations that they submitted claims on federal defense contracts while knowing they had not met the cybersecurity standards those contracts required. The Justice Department secured the deal, and it shows that a cyber lapse in a federal contract can now lead to fraud liability.

For defense and aerospace contractors, and for the subcontractors beneath them, that changes the math on a security gap. A missed control used to mean a failed audit or a lost bid. Now it can mean a federal fraud claim.

## What the Justice Department alleges against ILC

According to the government's account reported by [CyberScoop](https://cyberscoop.com/ilc-dover-cybersecurity-settlement-false-claims-act/), the two companies submitted claims for payment on federal defense contracts covering 2018 to 2024. The government says they did so while knowing they had not met those contracts' mandated cybersecurity standards.

The Justice Department's account, as reported by [ClearanceJobs](https://news.clearancejobs.com/2026/11/06/rei-systems-lands-nasa-sewp-vi-contract-and-defense-contractors-to-pay-13-million-over-cybersecurity-compliance-allegations/), names contracts with the Army, the Missile Defense Agency and NASA. ClearanceJobs published its coverage on November 6, and the story is still being picked up across the defense trade press.

The settlement came without an admission of liability. Parent company Ingersoll Rand, an American industrial manufacturer, said it inherited the compliance problem when it bought the firm. That is the company's own characterization, and it has not been tested independently.

The coverage reviewed for this story does not describe which specific cybersecurity controls ILC failed to meet. Anyone trying to judge the seriousness of the allegations should pull the full Justice Department text before drawing conclusions about the technical failures.

Brett Shumate, the Assistant Attorney General for the Justice Department's Civil Division, put the message plainly in remarks quoted by CyberScoop: “defense and aerospace contractors must comply with the cybersecurity requirements.”

## Why a cybersecurity lapse can become a fraud case

The False Claims Act lets private whistleblowers sue on the government's behalf and share in any recovery. That mechanism is the reason cybersecurity compliance has moved from the contracting office to the legal department. An employee who believes a company billed the government while falling short of required controls can bring the case, and the government can then join or take it over.

The ILC matter is not the first of its kind. On September 1, 2026, the Justice Department announced that Honeywell Aerospace agreed to pay $2,042,518 to settle allegations over gaps against NIST SP 800-171 in a Defense Department contract. The [Justice Department release on Honeywell](https://www.justice.gov/opa/pr/honeywell-aerospace-inc-agrees-pay-over-2m-settle-false-claims-act-allegations-failing) says that case began with a whistleblower suit, and the whistleblower received $375,823 as their share.

In that release, Shumate said: “The Justice Department will continue to investigate potential violations of these cybersecurity requirements to protect this critical information.” The line is a signal that the Honeywell settlement was not a one-off.

[Yahoo Finance's report on the Honeywell settlement](https://finance.yahoo.com/technology/ai/articles/honeywell-aerospace-settles-doj-2m-115400716.html) describes a broader pattern in which the Justice Department has sued government contractors for allegedly failing NIST's defense cybersecurity rules while still submitting claims for payment. The law firm Shumaker, quoted in the same coverage, describes cybersecurity compliance as “increasingly becoming enterprise legal risk.”

## Which contractors carry the most exposure

The exposure is broad. Under the Defense Federal Acquisition Regulation Supplement, the NIST SP 800-171 controls apply to subcontracts, including subcontracts for commercial products and services, when covered defense information is involved, according to [Nixon Peabody's analysis of the Honeywell settlement](https://www.nixonpeabody.com/insights/alerts/2026/09/09/honeywell-settlement-shows-fca-risk-for-nist-800-171-gaps). A small supplier that never holds a prime contract can still be bound by those requirements.

The Level 2 self-assessments under the Cybersecurity Maturity Model Certification program measure a company against the 110 requirements in NIST SP 800-171 Revision 2. Those scores are the numbers that go on paper, which is why accuracy matters so much. A score that describes the controls a company hoped it had, rather than the ones it actually ran, creates the kind of gap that can turn into a false claim.

The groups most affected are US defense and aerospace contractors, their subcontractors, and the federal agencies that buy from them. Consumers are not directly affected by this case.

## Practical steps for contractors that hold federal data

The ILC and Honeywell matters point to a short list of things compliance and IT teams can do now. None of these steps replaces legal advice, but each one reduces the chance of a gap going unnoticed for years.

- Recheck your NIST SP 800-171 self-assessment score against the controls you actually operate today, and document the evidence behind each claimed control.
- Verify that every third-party host that stores or processes covered defense information meets the required security standards, and get written proof rather than relying on a vendor's marketing.
- Document controls throughout contract performance, not only at assessment time, so you can show what was in place in any given year.
- Audit acquired subsidiaries before and after a deal closes. The government's account of ILC covers 2018 to 2024, and Ingersoll Rand's claim that it inherited the problem shows how an acquisition can carry compliance debt forward.
- Treat internal reports of control gaps as legal matters. Employees can file whistleblower suits under the False Claims Act, and a quiet fix to a documented gap may not satisfy a government investigator who asks why the gap existed.

## What comes next for CMMC and DFARS

The rules are shifting under contractors while these cases move through the courts. Nixon Peabody notes that CMMC Phase II is paused, while the DFARS cyber clause still binds contractors today. Government contract attorneys quoted by CyberScoop say a forthcoming regulatory overhaul could expose more companies to False Claims Act penalties.

Several questions remain open. The reporting does not show whether the ILC settlement is part of a broader sweep of defense contractors, and it does not say what the forthcoming overhaul will require. Those answers will shape how many companies face exposure and how quickly.

Watch for the full Justice Department release on ILC, which should confirm the announcement date and the contracting details. Watch also for any proposed rule that changes how self-assessments are scored or verified. If the government keeps pairing cyber requirements with fraud enforcement, the cost of an inaccurate score will keep rising for every company that signs a federal contract.

## Frequently asked questions

### How much did ILC Dover and ILC Astrospace agree to pay?

ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million in total to settle False Claims Act allegations. The settlement was reached without an admission of liability, according to the Justice Department as reported by CyberScoop. The contracts involved the Army, the Missile Defense Agency and NASA.

### What time period does the ILC cybersecurity settlement cover?

The government says the noncompliance covered 2018 to 2024. Parent company Ingersoll Rand said it inherited the compliance problem when it bought the firm, a characterization that has not been independently tested. The specific cybersecurity failures at ILC were not detailed in the coverage reviewed for this story.

### Do NIST SP 800-171 requirements apply to subcontractors?

Yes, when covered defense information is involved. The controls apply through the DFARS clause to subcontracts, including subcontracts for commercial products and services. Level 2 self-assessments under CMMC measure a company against the 110 requirements in NIST SP 800-171 Revision 2.

### Can employees trigger a False Claims Act case over cybersecurity?

Yes. The False Claims Act lets private whistleblowers sue on the government's behalf and share in any recovery. The Honeywell case began with a whistleblower suit, and that whistleblower received $375,823 as their share.

### Is CMMC currently enforced?

Nixon Peabody notes that CMMC Phase II is paused, while the DFARS cyber clause still binds contractors. Companies should not treat the pause as relief, because the contractual cybersecurity requirements and False Claims Act exposure remain in force.

## Sources

1. [Defense and aerospace firm settles with government over allegedly failing to meet cybersecurity contract requirements — CyberScoop](https://cyberscoop.com/ilc-dover-cybersecurity-settlement-false-claims-act/)
2. [REI Systems Lands NASA SEWP VI Contract and Defense Contractors to Pay $13 Million Over Cybersecurity Compliance Allegations — ClearanceJobs](https://news.clearancejobs.com/2026/11/06/rei-systems-lands-nasa-sewp-vi-contract-and-defense-contractors-to-pay-13-million-over-cybersecurity-compliance-allegations/)
3. [Honeywell Aerospace Inc. Agrees to Pay Over $2M to Settle False Claims Act Allegations (Office of Public Affairs, U.S. Department of Justice)](https://www.justice.gov/opa/pr/honeywell-aerospace-inc-agrees-pay-over-2m-settle-false-claims-act-allegations-failing)
4. [Honeywell Aerospace settles with DOJ for $2M over cybersecurity claims — Yahoo Finance](https://finance.yahoo.com/technology/ai/articles/honeywell-aerospace-settles-doj-2m-115400716.html)
5. [Honeywell settlement shows FCA risk for NIST 800-171 gaps — Nixon Peabody](https://www.nixonpeabody.com/insights/alerts/2026/09/09/honeywell-settlement-shows-fca-risk-for-nist-800-171-gaps)