Johnson Controls Inc. and two subsidiaries have agreed to pay $5 million to resolve US government allegations that they failed to comply with cybersecurity requirements in federal contracts and subcontracts.
The settlement announced on 13 November covers Johnson Controls Fire Protection LP and Johnson Controls Security Solutions LLC as well as the parent company. It concerns building products and services, including heating, ventilation and air-conditioning work, supplied under contracts involving NASA and the Departments of Defense, Energy and Justice.
Federal officials alleged that, between January 2018 and August 2025, the companies lacked sufficient information about their systems and sufficient controls over access to protected government information. For contracts incorporating NIST Special Publication 800-171, the government also alleged that Johnson Controls did not maintain a compliant System Security Plan and did not adequately document, develop or implement plans to correct deficiencies.
The resolution settles two False Claims Act suits filed under the statute’s qui tam provisions. Former employee Kelly Vance will receive $850,000 from the recovery. The cases are United States ex rel. Kelly Vance v Johnson Controls, Inc. in the Northern District of Georgia and United States ex rel. David Thomas v Johnson Controls International PLC in the District of Columbia.
The government’s case treats contractual cybersecurity promises as part of what agencies purchase, not merely as internal technical guidance. That approach allows alleged failures affecting federal information to be pursued through the False Claims Act where payment claims are linked to compliance representations.
The settlement resolves allegations without a determination of liability. It does not establish that government information was compromised, and the announcement does not identify a particular intrusion caused by the alleged control failures.
