Johnson Controls Inc. and two of its subsidiaries agreed to pay $5 million to resolve allegations that they violated the False Claims Act by failing to comply with cybersecurity requirements for federal contracts, the Justice Department announced Friday.
The allegations involve contracts and subcontracts for building products and heating, ventilation, and air conditioning services. The contracts were with the National Aeronautics and Space Administration and the Departments of Defense, Energy, and Justice.
From January 2018 to August 2025, Johnson Controls allegedly failed to implement security controls required to protect government information. The Justice Department said the company failed to control access to protected information because it lacked sufficient information regarding its information systems and lacked sufficient control over them.
For contracts requiring compliance with National Institute of Standards and Technology cybersecurity controls, the company allegedly failed to maintain a System Security Plan that met the requirements. The government also alleged the company failed to adequately document, develop or implement a plan to correct deficiencies and reduce vulnerabilities in its systems.
Acting Assistant Attorney General Jonathan Guynn said contractors must follow required standards to safeguard sensitive government information.
The agreement resolves two whistleblower lawsuits filed under the False Claims Act, which allows private citizens to sue on behalf of the government and share in any recovery. Kelly Vance, a whistleblower who formerly worked for Johnson Controls, will receive $850,000 from the settlement.
The Justice Department stated that the claims are allegations only, and there has been no determination of liability.