Johnson Controls settles U.S. cybersecurity fraud allegations for $5 million

Traders Union
All News
Business & Wealth
Companies
Johnson Controls fraud settlement

Highlights

Johnson Controls agreed to pay $5 million to settle U.S. Department of Justice allegations of failing to meet federal cybersecurity contract requirements from January 2018 to August 2025.
The settlement resolves two qui tam lawsuits, with whistleblower Kelly Vance receiving $850,000 as his share of the recovery.
The case highlights increased DOJ enforcement of cybersecurity compliance in federal contracts, emphasizing continuing financial and legal risks for government contractors.

Settlement terms and alleged contract failures

As reported by the U.S. Department of Justice, the settlement resolves allegations that Johnson Controls violated the False Claims Act by failing to comply with cybersecurity requirements in federal contracts and subcontracts tied to building products and services, including HVAC work.

The Justice Department says the company, along with Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC, entered into agreements from January 2018 to August 2025 with NASA and the Departments of Defense, Energy, and Justice that required specific security controls to protect government information.

Authorities allege the contractor failed to control access to protected information because it lacked sufficient information about its systems and sufficient control over those systems. For contracts requiring compliance with National Institute of Standards and Technology Special Publication 800-171, including Defense Department work, the company also allegedly failed to maintain a system security plan meeting contract terms and did not adequately document, fully develop, or fully implement remediation steps to address deficiencies and vulnerabilities.

The settlement resolves allegations only, and there has been no determination of liability.

Whistleblower payout and wider enforcement impact

The case also resolves two qui tam lawsuits filed under the False Claims Act, which allows private individuals to sue on behalf of the government and share in recoveries. Former Johnson Controls employee Kelly Vance is set to receive $850,000 from the settlement as his share.

Justice Department officials and investigators from multiple agencies say the case underscores that cybersecurity clauses in federal contracts are treated as binding obligations, particularly where national security and sensitive government operations are involved. The matter involved coordination across the Civil Division, U.S. Attorney's Offices in Georgia and the District of Columbia, and investigative units including DCIS, NCIS, NASA OIG, the Department of Energy OIG, the Department of Justice OIG, and GSA OIG.

The case adds to broader U.S. efforts to use False Claims Act enforcement against contractors accused of misrepresenting or neglecting cybersecurity controls. For companies working with federal agencies, the resolution signals continued financial and legal risk where internal security documentation, access controls, and corrective action plans fall short of contract requirements.

Previously, we outlined the main factors behind Switzerland’s mercenary law compliance risks for defence groups operating abroad.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.