Business, Technology & Federal Contracts
Johnson Controls Settlement Puts Contract Cybersecurity Records in Focus
DOJ announces a $5 million resolution involving three companies. The claims remain allegations, with no determination of liability.
A civil resolution of contract allegations
Johnson Controls and two subsidiaries agreed to pay $5 million to resolve False Claims Act allegations involving cybersecurity duties in federal contracts and subcontracts, DOJ announced Friday. The work included building products and services. The department expressly says there has been no determination of liability.
The alleged gaps
DOJ says the allegations concern contracts from January 2018 through August 2025 with agencies including NASA and the departments of Defense, Energy and Justice. They involve controls over protected information and, for some contracts, documentation and corrective-action planning required by NIST Special Publication 800-171.
Records are part of the obligation
The case highlights a distinction between supplying a physical product and meeting the information-security conditions attached to a contract. The release does not establish that every company system was compromised or that an adversary stole particular government records. It resolves allegations rather than reporting a criminal conviction. Contractors assessing their own obligations need the actual contract terms and security records, not an assumption that one settlement defines every federal procurement requirement.
Primary evidence
Reporting note: This independently composed article is based on the linked primary records. Publication and event dates are stated separately. Agency claims are identified as such; an allegation, charge or scheduled event is not presented as a finding, conviction or completed event. Readers should consult the official record for amendments and later action.