The Justice Department on Tuesday said defense and aerospace contractors ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million to resolve allegations that they violated the False Claims Act by failing to meet cybersecurity requirements in federal contracts.

The department said the allegations involve contracts with the Department of the Army, the Missile Defense Agency, and the National Aeronautics and Space Administration. Assistant Attorney General Brett A. Shumate of the Civil Division said, “We will continue our efforts to hold accountable government contractors and subcontractors that fail to meet their cybersecurity commitments.”

According to the department, the settlement resolves allegations that from January 2018 to October 2024 the companies submitted false or fraudulent claims for payment while knowing they had not complied with contract cybersecurity requirements. The department alleged that from February 2023 to October 2024 the companies used a third-party cloud service to store controlled unclassified information without ensuring the service met security standards equivalent to the Federal Risk and Authorization Management Program Moderate baseline and certain Defense Department reporting and forensic access requirements.

The department also alleged that from January 2018 to March 2022, and from September 2022 to October 2024, the companies did not develop and update required system security plans for covered information systems. Further, from January 2018 to October 2024, they allegedly had not fully implemented security controls in National Institute of Standards and Technology Special Publications 800-171 and 800-53. The department said that from January 2018 to May 2019, and from January 2022 to September 2024, they allegedly lacked required plans of action and milestones to correct deficiencies.

The department alleged that from November 2020 to October 2024, ILC Astrospace did not submit to the Defense Department any current assessment of its implementation of NIST 800-171 controls, and that ILC Dover did not submit a current assessment conducted in accordance with the Defense Department’s assessment methodology.

U.S. Attorney Benjamin L. Wallace for the District of Delaware said the obligations at issue exist to prevent bad actors from taking advantage of U.S. technical innovation. Investigators from the Defense Criminal Investigative Service, Army Criminal Investigation Division, Navy Criminal Investigative Service, Air Force Office of Special Investigations, NASA Office of Inspector General, and the General Services Administration Office of Inspector General assisted. Robert Steinau, Assistant Inspector General for Investigations at the NASA Office of Inspector General, said, “Strict compliance with federal cybersecurity standards is non-negotiable for any company doing business with NASA.”

The settlement resolves a lawsuit filed under the whistleblower provisions of the False Claims Act. The department said whistleblower Philip Root, ILC’s former director of cybersecurity, will receive $2.35 million. The case is United States ex rel. Root v. ILC Dover LP, et al., No. 25-cv-70 (D. Del.).

The department said this year the Administration launched the Task Force to Eliminate Fraud and the National Fraud Enforcement Division to bolster efforts against fraud, waste, and abuse in federal programs. The department said its False Claims Act work will support those efforts.

The Justice Department said the claims resolved by the settlement are allegations only and there has been no determination of liability.