On November 3, 2026, the DOJ announced that defense and aerospace contractors ILC Dover LP and ILC Astrospace LLC agreed to pay over $13 million to resolve False Claims Act (FCA) allegations involving cybersecurity requirements in Army, Missile Defense Agency, and NASA contracts and subcontracts.
The government alleged that, from 2018 through October 2024, ILC submitted claims while knowingly failing to satisfy contractual cybersecurity obligations. The alleged deficiencies included using a third-party cloud provider without ensuring FedRAMP Moderate-equivalent security; failing to maintain system security plans and plans of action and milestones; not fully implementing NIST controls; and lacking current Supplier Performance Risk System assessments. According to the settlement agreement, consultants had identified dozens of unimplemented controls, and ILC allegedly did not report the resulting assessment scores or vulnerabilities to the Department of Defense.
The resolution arose from a qui tam action filed in the District of Delaware by Philip Root, ILC’s former Director of Cybersecurity. Root will receive $2.35 million of the settlement proceeds.
Cybersecurity Documentation Is Part of the Control Environment
The settlement illustrates that cybersecurity FCA exposure is not limited to whether a breach occurred. The government’s theory connected payment claims to continuing compliance with clauses governing cloud providers, security plans, corrective-action tracking, control implementation, and current assessments.
Contractors should link each cybersecurity representation to the underlying system security plan, plan of action and milestones, assessment methodology, and remediation evidence. Vendor diligence should confirm that cloud providers satisfy incorporated requirements. Findings that conflict with an existing certification should be escalated to legal, compliance, contracts, and cybersecurity personnel before another claim or representation is submitted.
GWB represents government contractors and other organizations in connection with government investigations, cybersecurity compliance, and False Claims Act litigation. If you need assistance with such a matter, contact us today.
Get in Touch With Us
For more information or to arrange a consultation, please contact us by telephone at (404) 233-4171 or online by submitting the form below. The use of the Internet or this form for communication with the firm or any individual member of the firm does not establish an attorney-client relationship nor create an expectancy of a potential attorney-client relationship. Do not submit information which is confidential or time sensitive, as it may not be treated as such.