Two United States defence and aerospace contractors have agreed to pay US$13 million to resolve allegations that they submitted claims under federal contracts while failing to meet required cybersecurity safeguards.
The settlement covers ILC Dover LP and ILC Astrospace LLC, Delaware companies that held contracts with the Army, Missile Defense Agency and NASA. The Justice Department alleged that claims submitted between January 2018 and October 2024 were false because the companies knew that covered information systems did not comply with contractual security requirements.
The alleged gaps included use of a third-party cloud provider without ensuring protections equivalent to the FedRAMP Moderate baseline, incomplete system-security plans and unimplemented controls from NIST publications 800-171 and 800-53. Prosecutors also said corrective plans were missing during portions of the relevant period and that required Defence Department cybersecurity assessments were absent or out of date.
The resolution arose from a whistleblower action filed by Philip Root, a former ILC cybersecurity director, under the False Claims Act’s qui tam provisions. Root will receive US$2.35 million from the recovery. The civil case is United States ex rel. Root v ILC Dover LP, No. 25-cv-70, in the District of Delaware.
The agreement resolves civil allegations; it is not a judicial finding that either company committed fraud. The Justice Department expressly said there had been no determination of liability.
The department’s announcement, which links to the settlement agreement, is available here.
