Johnson Controls agrees to pay $5 million over alleged security plan gaps in federal contracts

Editor’s Note: Johnson Controls Inc. of Milwaukee and two subsidiaries, Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC, agreed to pay $5 million to resolve Justice Department allegations, announced Nov. 13, 2026, that from 2018 to 2025 they failed to meet cybersecurity requirements in 25 federal contracts and subcontracts. The government contends the companies did not control access to protected information. For contracts carrying Pentagon procurement rules that require a federal security standard known as NIST SP 800-171, it also contends their system security plan, the document describing how their systems meet that standard, did not fully meet contract terms, and that their plan for fixing gaps was not fully developed or implemented. The agreement says it is not an admission of liability, and the department calls the claims allegations only. The settlement resolves two qui tam suits, in which private citizens sue on the government’s behalf, filed by former employees Kelly Vance and David Thomas; Vance is to receive $850,000.

For cybersecurity, compliance and eDiscovery professionals, the allegations center on security documentation. Watch the dismissal filings and any agency use of the debarment rights the agreement reserves.

News Analysis – Cybersecurity Beat

Johnson Controls agrees to pay $5 million over alleged security plan gaps in federal contracts

ComplexDiscovery Staff

Johnson Controls Inc. and two subsidiaries agreed to pay $5 million to resolve Justice Department allegations that they failed to meet cybersecurity requirements in federal contracts for building products and services, the department said Nov. 13.

Much of the government’s account turns on two documents that contractors must keep under National Institute of Standards and Technology (NIST) Special Publication 800-171, a federal security standard. In the settlement agreement, the government contends that the companies’ system security plan did not fully meet contract terms and that their plan for fixing known deficiencies was neither fully developed nor fully put into practice.

The settling companies are Johnson Controls Inc. of Milwaukee and two Milwaukee-headquartered subsidiaries, Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC. Under the 17-page agreement the department posted with its release, the companies agreed to pay $5 million plus interest, and $2,428,565.80 of that sum is designated as restitution. The agreement, entered on behalf of the Air Force, Army, Navy, NASA and the Energy and Justice departments, lists 25 contracts or subcontracts and covers conduct from Jan. 1, 2018, to Aug. 1, 2025. The list is not limited to formal prime contracts: It includes subcontracts, General Services Administration schedule orders, purchase orders and a credit card purchase. The agreement states that it is not an admission of liability by the companies, and the department’s main release says the claims are allegations only, with no determination of liability. The U.S. Attorney’s Office for the Northern District of Georgia, in Atlanta, issued a companion release the same day.

What the government says went wrong

The allegations come in two layers, and the scope of each matters. Across all 25 contracts, the government contends the companies “failed to control access to protected information” because they lacked sufficient information about, or control over, their own systems. The second layer applies only to the contracts that carried Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7008 or 252.204-7012, both of which make NIST SP 800-171 the security baseline.

For those contracts, the agreement describes what a compliant system security plan (SSP) must contain: system boundaries, the environments in which the system operates, how each security requirement is implemented, and the system’s connections to other systems. It then alleges that the companies’ plan did not fully meet the contractual requirements. Each unmet requirement, the agreement says, calls for a plan of action and milestones (POA&M) that corrects the deficiency, and it alleges the companies did not “adequately document, fully develop, or fully implement” such a plan.

The dates track the deadline. The agreement says those DFARS provisions required contractors to implement NIST SP 800-171 no later than Dec. 31, 2017, and the covered period opens the following day and runs for over seven years. U.S. Attorney Theodore S. Hertzberg of the Northern District of Georgia said his office would go after contractors that do not meet cybersecurity requirements, “particularly when those failures persist over several years.”

A compliance gap is not by itself a False Claims Act violation. The statute reaches anyone who “knowingly presents, or causes to be presented, a false or fraudulent claim for payment or approval,” or who knowingly creates or uses a false record that is material to such a claim. It defines knowledge to include actual knowledge, deliberate ignorance and reckless disregard, and the government need not prove a specific intent to defraud. The two Justice Department releases and the agreement never use the words “knew” or “knowingly,” while the department’s ILC Dover and MORSECORP releases said those companies knew they had not complied.

Officials framed the underlying obligations in flat terms. “Cybersecurity requirements in federal contracts are not optional,” said James Ives, director of the Defense Criminal Investigative Service in the Pentagon’s inspector general office. Jonathan Guynn, acting assistant attorney general for the Justice Department’s Civil Division, said contractors “must follow required cybersecurity standards to safeguard sensitive government information,” and he said the department would keep working with law enforcement partners to hold violators accountable.

Whistleblower suits from former employees

Both suits came from former Johnson Controls employees, according to the Atlanta office’s companion release. Kelly Vance filed a sealed qui tam complaint in the U.S. District Court for the Northern District of Georgia on June 7, 2024, and amended it in March 2025. The False Claims Act lets private citizens sue on the government’s behalf and collect part of what the government recovers. Vance’s complaint was filed about two years and five months before the department’s announcement, and the releases and the agreement are silent on when the company learned of it.

A second relator, David Thomas, filed under seal in federal court in the District of Columbia on Feb. 11, 2026, naming Johnson Controls International PLC and others as defendants. The department’s main release identifies only Vance as a former employee, and neither release compares the relators’ allegations. Their complaints were not retrieved for this article.

The money flows through Vance. The agreement directs the government to pay him $850,000, or 17 percent of the $5 million principal, and records that on Sept. 14, 2026, the two relators reached their own agreement to divide part of that award. Johnson Controls is also to pay $135,000 to Vance’s counsel and $163,750 to Thomas’ counsel for expenses, attorneys’ fees and costs.

Where $5 million sits in recent cyber cases

Ten days before the Johnson Controls announcement, on Nov. 3, the department said ILC Dover LP and ILC Astrospace LLC had agreed to pay $13 million over alleged cybersecurity failures in Army, Missile Defense Agency and NASA contracts. The Johnson Controls figure falls below that and below the $8.4 million Raytheon and Nightwing settlement of May 2025, and above MORSECORP’s $4.6 million in March 2025 and Honeywell Aerospace’s $2,042,518 on Sept. 1, 2026. In June 2026, the department announced a $507,144 settlement with LOGZONE Inc. over alleged failures in two Navy contracts.

The $5 million principal is about 2.06 times the restitution figure. The law firm Arnold & Porter, writing about the ILC agreement, said half of that settlement was identified as restitution, which in the firm’s reading meant “a multiplier of two was used.” The Johnson Controls agreement does not explain how its own figure was calculated.

The releases do not use the name of the Civil Cyber-Fraud Initiative, which the department launched in 2021. They also do not mention the Cybersecurity Maturity Model Certification (CMMC) program, whose Phase 2 requirements the Pentagon suspended four months before the department announced this settlement. Those requirements had been scheduled to begin Nov. 10, 2026. Law firms advising contractors, including Clark Hill, said companies that hold covered defense information are still bound by their DFARS 252.204-7012 obligations.

Johnson Controls International disclosed a cybersecurity incident in September 2023, and CNN reported that Department of Homeland Security officials were working to determine whether a ransomware attack on the company had compromised sensitive physical security information. Neither release nor the agreement mentions that attack or any other cyber incident.

Building the record before a relator does

What the documents allege instead are failures to control access and gaps between the contracts’ requirements and the companies’ plans and controls. For security, compliance and legal teams, the DFARS allegations read like a preview of a document request, and the agreement’s description of what an SSP must contain works as a ready checklist. Contractors should keep dated versions of the plan and of every POA&M, with the evidence that each milestone was met or missed, because dated versions can help establish when a gap opened or closed.

Cost is a second lesson. The agreement treats as unallowable the companies’ costs of the government’s audits and investigation, their own investigation, defense and corrective actions in response, including attorneys’ fees, and the negotiation of and payments under the agreement. Johnson Controls cannot charge those costs, directly or indirectly, to any federal contract.

The agreement also leaves exposure open. The government reserved criminal liability, the liability of individuals and agencies’ suspension and debarment rights, among other claims. Once the money is received, the two suits are to be dismissed with prejudice as to the relators and as to the government’s claims over the covered conduct, but otherwise without prejudice to the United States.

The case’s insider origin matters for information governance as well. An employee who reports NIST gaps internally may also be a potential relator, so the internal report warrants prompt legal review of whether preservation duties have attached, along with a documented investigation and protection against retaliation. The False Claims Act separately protects employees, contractors and agents against retaliation for lawful acts taken to advance a False Claims Act case or to stop violations of the act. Neither Justice Department release nor the agreement describes a retaliation claim, and both relators released the companies from any other claims they had, known or unknown, arising before the agreement took effect.

A system security plan is a contractor’s own account of how its systems meet the security requirements. In this case it sits at the center of the government’s DFARS allegations, and the claims about its gaps are part of what the companies agreed to pay $5 million to resolve. If your own plan were read tomorrow by a former employee’s lawyer, would its version history show a program, or a promise?

News Sources

• HVAC Supplier Johnson Controls Inc. and Two Subsidiaries Agree to Pay $5 Million to Settle Cybersecurity Fraud Allegations (U.S. Department of Justice)
• Johnson Controls, Inc. and Two Subsidiaries Agree to Pay $5 Million to Settle Federal Fraud Allegations (U.S. Attorney’s Office, Northern District of Georgia)
• Settlement Agreement: United States, Johnson Controls, Inc., Johnson Controls Fire Protection LP, Johnson Controls Security Solutions LLC and Relators (U.S. Department of Justice)
• 31 U.S. Code § 3729: False claims (Legal Information Institute, Cornell Law School)
• 31 U.S. Code § 3730: Civil actions for false claims (Legal Information Institute, Cornell Law School)
• Defense and Aerospace Contractors ILC Dover and ILC Astrospace Agree to Pay $13M to Resolve Cybersecurity Fraud Allegations (U.S. Department of Justice)
• Honeywell Aerospace Inc. Agrees to Pay Over $2M to Settle False Claims Act Allegations of Failing to Comply with Cybersecurity Requirements in a U.S. Department of Defense Contract (U.S. Department of Justice)
• Alabama Defense Contractor Agrees to Pay $507,144 to Resolve False Claims Act Liability Relating to Cybersecurity Violations (U.S. Department of Justice)
• Raytheon Companies and Nightwing Group to Pay $8.4M to Resolve False Claims Act Allegations Relating to Non-Compliance with Cybersecurity Requirements in Federal Contracts (U.S. Department of Justice)
• Defense Contractor MORSECORP Inc. Agrees to Pay $4.6 Million to Settle Cybersecurity Fraud Allegations (U.S. Department of Justice)
• Court Appoints Theodore S. Hertzberg as United States Attorney for the Northern District of Georgia (U.S. Attorney’s Office, Northern District of Georgia)
• Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements (U.S. Department of War)
• Exclusive: DHS investigating whether floor plans and other security information were exposed in ransomware attack on contractor (CNN via KTVZ)
• DOJ Secures $13 Million From DoD Contractor in Largest Cybersecurity FCA Resolution to Date (Arnold & Porter)
• DoW Suspends the Nov 10, 2026 CMMC Phase 2 Deadline: What Government Contractors Need to Know (Clark Hill)
• The DOJ’s Cyber FCA Playbook Is Working as Enforcement Triples and Shows No Signs of Slowing (ComplexDiscovery)

Assisted by GAI and LLM Technologies

Additional reading

• Officials tie FAA ground stop to contractor router work, not hackers, but the specific fault is still undetermined
• Notion AI chats surface in Fireworks breach, testing what zero retention covers
• France ties October supermarket fridge sabotage to Iran’s IRGC and seeks arrest warrants
• ENISA’s update advisory turns the patch pipeline into an evidence trail
• Britain’s cyber agency warns of a possible surge, and its own incident figures raise a question
• Supermarket freezer attacks reach at least six European countries, and the record linking them to US base failures stays thin
• Microsoft finds 2 North Korean groups using ARTEX, a tool that alone cannot name an attacker
• With over 40 percent of the record Binance theft frozen, getting it back becomes a legal project
• Estonia’s cyber authority saw no state-sector PHP crisis as three state institutions shut or restricted services
• AI recording spreads in Estonian health care as the regulator says the audio needs its own legal basis

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.