DOJ announces $13 million settlement over contractor cybersecurity allegations

DOJ announced on November 3, 2026 that ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million to resolve False Claims Act allegations concerning cybersecurity requirements in Army, Missile Defense Agency and NASA contracts. DOJ states that the resolved claims are allegations only and that there has been no determination of liability; the agreement is not an admission of liability by ILC.

The alleged deficiencies concerned several connected forms of security evidence: system security plans, implementation of applicable NIST SP 800-171 and SP 800-53 controls, plans of action and milestones, and current DoD assessments. DOJ also alleged that ILC used a third-party cloud provider for controlled unclassified information without requiring and ensuring the specified FedRAMP Moderate-equivalent safeguards and DoD incident-handling protections.

The agreement connects the DoD assessment process to the system security plan: an assessment needs the plan describing how requirements are met. The case therefore concerns more than whether a score was entered; the underlying system scope, implementation evidence and assessment basis matter. The requirements discussed are those in the named contracts and the alleged conduct periods, not a new blanket standard issued on November 3.

For ISSOs and control assessors supporting federal contractors, the practical review is to trace each contractual security obligation to the responsible system, evidence owner and assessment record. Reconcile claimed implementation with the current security plan and remediation tracking, and verify that external cloud dependencies are covered. These are editorial implementation considerations; the responsible contracting and legal teams should determine actual clause applicability, versions and reporting duties.