Federal Contracting & Cybersecurity
Aerospace Contractors Agree to $13 Million Cybersecurity Settlement
ILC Dover and ILC Astrospace resolved federal allegations involving contract cybersecurity controls for Army, Missile Defense Agency and NASA work.
A civil resolution
ILC Dover and ILC Astrospace agreed to pay $13 million to resolve Justice Department allegations under the False Claims Act. The government alleged that the companies sought payment on federal contracts while knowing that required cybersecurity practices were not fully in place. The contracts involved the Army, Missile Defense Agency and NASA. A settlement resolves disputed claims without a trial finding on each allegation.
The controls at issue
The department identified allegations involving system security plans, implementation of federal cybersecurity controls, remediation plans and contractor assessments. It also alleged that a third-party cloud provider stored controlled unclassified information without contractually required safeguards. These are governance and evidence questions as much as technical ones: contractors must be able to show how required controls apply to systems handling protected federal information.
Why controlled information matters
Controlled unclassified information is not the same as classified national-security material, but contracts can impose specific requirements for its protection, incident reporting and forensic access. The settlement record describes standards drawn from NIST publications and Defense Department clauses. Compliance therefore depends on the exact contract, information system and period involved, not on a generic claim that a company has a cybersecurity program.
The whistleblower case
The agreement traces the matter to a qui tam lawsuit filed in federal court in Delaware in January 2025. The False Claims Act permits eligible private relators to bring allegations on behalf of the United States, subject to statutory procedures. The settlement agreement, rather than the agency headline, supplies the parties, contracts and defined allegations. It should be read as the governing record of the resolution.
A lesson for the supply chain
Federal contractors and subcontractors should connect representations in invoices and certifications to current technical evidence. Using a vendor or cloud service does not transfer away the duty to verify contractual requirements. The case also shows that cybersecurity enforcement can proceed through procurement and civil-fraud law even when no public data breach is alleged. Future monitoring will determine whether remediation and documentation remain effective.
Primary evidence
Reporting note: This independently composed article is based on the linked primary records. Publication and event dates are stated separately. Agency claims are identified as such; an allegation, charge or scheduled event is not presented as a finding, conviction or completed event. Readers should consult the official record for amendments and later action.