Johnson Controls and Subsidiaries Settle for $5 Million Over Federal Cybersecurity Compliance Failures

Johnson Controls, Inc., headquartered in Milwaukee, Wisconsin, along with its subsidiaries Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC (collectively “Johnson Controls”), have agreed to a $5 million settlement to resolve allegations of False Claims Act violations related to cybersecurity compliance failures in federal contracts.

The allegations stem from contracts and subcontracts entered into between January 2018 and August 2025 with the National Aeronautics and Space Administration (NASA), the Departments of Defense, Energy, and Justice. These contracts required Johnson Controls to implement specific cybersecurity controls to safeguard sensitive government information, including compliance with National Institute of Standards and Technology (NIST) Special Publication 800-171 standards.

According to the Justice Department, Johnson Controls failed to adequately control access to protected information due to insufficient knowledge and control over its information systems. Furthermore, for contracts mandating adherence to NIST SP 800-171—particularly Department of Defense contracts—the company allegedly did not maintain a compliant System Security Plan, nor did it fully develop or implement a plan of action and milestones to address cybersecurity deficiencies and vulnerabilities.

Acting Assistant Attorney General Jonathan Guynn emphasized the importance of federal contractors adhering to cybersecurity standards, stating, “The Justice Department will continue working with its law enforcement partners to ensure that federal agencies and taxpayers get what they paid for and to hold accountable government contractors who violate cybersecurity requirements.”

U.S. Attorney Theodore S. Hertzberg highlighted the risks posed by prolonged noncompliance, noting, “My office will vigorously pursue contractors who fail to follow these requirements, particularly when those failures persist over several years, needlessly exposing our nation to malevolent attacks and exploitation by bad actors.”

Officials from multiple agencies involved in the investigation underscored the critical nature of cybersecurity in federal contracting. James Ives, Director of the Department of Defense Office of Inspector General Defense Criminal Investigative Service (DCIS), remarked, “Cybersecurity requirements in federal contracts are not optional. They are binding obligations that protect sensitive government information.”

Brian Merkal, acting Special Agent in Charge of the Naval Criminal Investigative Service (NCIS) Economic Crimes Field Office, added, “Defense contractors who misrepresent their cybersecurity credentials and fail to safeguard critical infrastructure pose a direct threat to our Department of the Navy installations and warfighters.”

Kathryn Sheehey, Senior Official at the NASA Office of Inspector General, noted the impact on space program security: “By failing to control access to sensitive information, this contractor put America’s space program at risk.”

Floyd Martinez, Special Agent in Charge of the General Services Administration Office of Inspector General Southeast and Caribbean Investigations Division, stated, “Government contractors must be honest and vigilant in protecting the sensitive information entrusted to them.”

The settlement resolves two qui tam lawsuits filed under the False Claims Act by whistleblowers Kelly Vance, a former Johnson Controls employee, and David Thomas. Under the Act, private citizens can sue on behalf of the government and share in any recovery. As part of the settlement, Vance will receive $850,000. The cases are captioned United States ex rel. Kelly Vance v. Johnson Controls, Inc., No. 1:24-cv-2500 (N.D. Ga.) and United States ex rel. David Thomas v. Johnson Controls Int’l PLC, No. 1:26-cv-448 (D.D.C.).

This enforcement action aligns with the Administration’s broader efforts to combat fraud, waste, and abuse in federal programs, including the recently launched Task Force to Eliminate Fraud and the National Fraud Enforcement Division.

The resolution was achieved through coordinated efforts among the Department of Justice Civil Division’s Commercial Litigation Branch, U.S. Attorney’s Offices for the Northern District of Georgia and the District of Columbia, Defense Criminal Investigative Service, NCIS, Air Force Office of Special Investigations, NASA Office of Inspector General, Department of Energy Office of Inspector General, Department of Justice Office of Inspector General, and General Services Administration Office of Inspector General.

The matter was handled by Trial Attorney Jennifer Cook, Assistant U.S. Attorney Adam Nugent for the Northern District of Georgia, and Assistant U.S. Attorney Sean Tepe for the District of Columbia.

The claims resolved by the settlement are allegations only; no determination of liability has been made.

Official reference: View the original document.