A whistleblower's lawsuit has cost Honeywell Aerospace Inc. more than $2 million and put a permanent mark on the company's record for cybersecurity failures on a U.S. Department of Defense contract. Honeywell Aerospace has agreed to pay $2,042,518 to resolve False Claims Act allegations that it failed to comply with federally mandated cybersecurity requirements on one of its networks while performing a Defense Department contract, the Justice Department announced September 1.

The Phoenix-based company, which builds avionics, engines and other systems for military and commercial aircraft, is accused of falling short of the National Institute of Standards and Technology's Special Publication 800-171 — the baseline cybersecurity controls that contractors handling controlled unclassified defense information must implement. According to the Justice Department, the lapse on Honeywell Aerospace's network ran from April 2020 through December 2023, nearly four years during which the company was contractually obligated to safeguard the information but allegedly did not meet the standard.

Honeywell Aerospace became a standalone, publicly traded company on June 29, 2026, after Honeywell International, based in Charlotte, North Carolina, spun off its aerospace division. The settlement covers conduct that predates the spinoff, when the aerospace business operated as a unit of the parent company, but the newly independent Honeywell Aerospace is the entity paying the government.

How a Former Employee's Lawsuit Uncovered the Gap

The case did not start as a government audit. It began as a qui tam lawsuit filed under the False Claims Act's whistleblower provisions, which let private citizens sue on the government's behalf and share in any recovery. The suit, United States ex rel. Rachel Tenney v. Honeywell International Inc., was filed in the U.S. District Court for the Western District of North Carolina under civil action number 3:22-cv-129. Tenney, a former Honeywell employee, brought the allegations forward and stayed in the case as the government investigated.

That investigation was a joint effort. The Justice Department's Civil Division, through its Commercial Litigation Branch, worked alongside the U.S. Attorney's Office for the Western District of North Carolina and the Defense Criminal Investigative Service, the Defense Department's investigative agency for fraud tied to military contracts. Senior Trial Counsel Greg Pearson and Assistant U.S. Attorney Holly Snow handled the matter for the government.

Justice Department officials framed the settlement as part of a broader push to hold contractors to the cybersecurity terms they agree to when they take defense work. "Government contractors that obtain defense information in administering their contracts must follow required cybersecurity standards," said Assistant Attorney General Brett A. Shumate of the Justice Department's Civil Division in the announcement.

Advertisement

U.S. Attorney Russ Ferguson, whose Western District of North Carolina office helped prosecute the case, put the stakes in plainer terms. "Cybersecurity requirements and standards for federal contractors are in place for a reason: to protect government systems and prevent unauthorized access to government data," Ferguson said.

$375,823 to the Whistleblower Who Flagged It

Tenney's share of the recovery — $375,823 — comes directly out of the settlement amount, a standard feature of qui tam cases meant to reward relators for stepping forward and to encourage others with knowledge of contractor fraud to do the same. The False Claims Act generally entitles a whistleblower to between 15 and 30 percent of whatever the government recovers, depending on how much the relator contributed to the case and whether the government intervened.

As is standard in these settlements, the Justice Department noted that the claims resolved by the agreement are allegations only, and that there has been no determination of liability. Honeywell Aerospace did not admit wrongdoing as part of the deal, a common structure in False Claims Act settlements that lets both sides avoid the cost and uncertainty of litigation.

The dollar figure is modest next to Honeywell's overall defense business, but it fits a broader enforcement pattern: the Justice Department has increasingly used the False Claims Act in recent years to pursue contractors that misrepresent their cybersecurity compliance or fail to report known gaps in the controls guarding defense information. Defense contractors that handle controlled unclassified information are required to implement the security controls spelled out in NIST Special Publication 800-171 — 110 requirements under the revision that was in effect for most of the period at issue in this case, before NIST updated the standard — covering everything from access control and incident response to system monitoring, and to accurately represent their compliance status to the government. A contractor that claims compliance it has not actually achieved — or simply fails to maintain a compliant network while billing under a contract that requires one — can find itself facing False Claims Act liability, since every invoice submitted under the contract can be treated as an implicit certification that the contractor is meeting its terms.

What It Means for Contractors

The Honeywell Aerospace settlement lands as the Pentagon continues rolling out the Cybersecurity Maturity Model Certification program, which will eventually require many contractors to prove — through third-party or self-assessment — that they meet NIST SP 800-171 controls before they can win or keep certain contracts. Cases like this one show that even before CMMC assessments become a widespread contract condition, the government already has a tool for punishing contractors that fall short of the cybersecurity terms baked into their existing agreements: the False Claims Act, paired with employees willing to file suit.

For contractors, the practical lesson is that cybersecurity compliance is not a paperwork exercise that can lag behind what a network actually does. A gap between the security controls a company has told the government it maintains and the controls actually running on its systems is the kind of discrepancy that can turn into a False Claims Act exposure, particularly when an insider notices the gap and has an incentive — a share of whatever the government recovers — to report it. Companies bidding on or performing defense contracts that involve controlled unclassified information should treat NIST SP 800-171 compliance as a standing obligation to verify continuously, not a one-time checkbox, and should have a way for employees to raise cybersecurity concerns internally before they become the basis for a whistleblower suit.

Sources